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PREFACE 


Many  significant  advances  in  optimal  control  theory,  synthesis  techniques  and  design 
methodology  have  taken  place  since  the  last  symposium  held  in  this  area  in  1973. 

The  rapidly  developing  technologies  in  computation,  data  distribution  systems,  computer 
aided  design  methods  and  data  bases  now  permit  application  of  theories  and  synthesis  methods 
heretofore  impractical. 

The  increased  emphasis  on  functional  and  performance  capability  at  reduced  cost 
suggests  application  of  technologies  and  methods  for  more  common  use  of  information  and 
higher  levels  of  integration. 

The  purpose  of  this  meeting  is  to  review  and  discuss  all  aspects  of  these  emerging 
technologies  ranging  from  theory  through  applications  including  aircraft,  missiles,  space 
vehicles  and  unmanned  vehicles.  ^ 


*  •  • 


Des  progres  nombreux  et  importants  en  mature  de  thiorie  de  contrale  optimal,  de 
techniques  de  synthese  et  de  methodes  conceptuelles  on t  Hi  rialisis  depuis  le  dernier 
symposium  con  sac  &  ce  domaine  en  1973. 

Involution  rapide  des  technologies  dans  le  domaine  du  calcul,  des  systimes  de 
diffusion  de  donnte.  des  etudes  automatisies  et  des  bases  de  donndes  permet  disorma is 
l'application  de  theories  et  de  methodes  de  syntheses  jusqu'ici  irrealisables. 

L'importance  croissante  donnee  aux  capacities  fonctionnelles  et  operationnelles  a 
coiit  riduit  conduit  i  l’application  de  technologies  et  de  methodes  permettant  un  partage 
plus  pousse  dans  I’utilisation  de  l’information  et  des  niveaux  d'integration  plus  eieves. 

Cette  reunion  se  propose  de  passer  en  revue  et  d’examiner  tous  les  aspects  des 
technologies  qui  se  font  jour  actuellement  et  qui  vont  du  domaine  de  la  theorie  i  celui  de 
l'application  en  ce  qui  conceme  les  avions,  les  missiles,  les  vthicules  spatiaux  et  les  vehicules 
non  pilotes. 
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PROGRESS  AMD  PITFALLS  H  ADVANCED  PLIGHT  COfTIOL  STSTBCS 

Duane  McRuer 

President  and  Technical  Director 

Systems  Technology,  Inc. 

13766  S.  Hawthorne  Blvd. 

Hawthorne,  CA  90230 


The  conjunction  of  multiple-fail-operational  fly-by-wire  flight  control  and  high-performance  new  air¬ 
craft  eer.^nology  has  been,  in  the  main,  a  favorable  one.  Major  weight  and  volume  reductions  and  perfor¬ 
mance  enhancements  have  been  achieved  by  automatic  and  manual  flight  control  system  (FCS)  integration, 
and  the  basic  airframe  can  now  truly  be  optimized  for  performance  properties  such  as  low  drag,  maximum 
maneuverability,  low  obaervablea,  etc*,  without  considering  some  of  the  traditional  penalties  imposed  by 
stability  and  control  requirements.  Instead,  the  new  flight  control  technology  can  redress  stability  and 
control  imbalances  and  even  provide  flying  quality  characteristics  that  border  on  the  absolute  optimum. 

This  new  technology  is  not  an  unmlxed  blessing.  Greater  FCS  complexity  and  cost  are  obvious  dis¬ 
advantages,  but  other  unfavorable  effects  are  more  subtle,  being  of  the  nature  of  side  effects  which 
accompany  the  favorable  major  effects.  Three  of  these  are  discussed  and  Illustrated  with  examples  in 
this  paper. 

The  first  is  associated  with  the  flight  control  and  flying  qualities  of  unstable  relaxed  static  sta¬ 
bility  aircraft.  In  solving  the  control  problem  an  "equivalent  vehicle"  Is  created  in  which  the  key 
dynamic  properties  comprise  a  mix  of  FCS  and  airframe  parameters.  Unfortunately,  the  equivalent  vehicle 
dynamics  may  no  longer  correspond  to  those  of  conventional  aircraft.  Instead,  they  are  different  in  kind 
as  well  as  degree.  There  are  very  few  flying  quality  data  that  are  appropriate  for  such  systems  and,  not 
surprisingly,  existing  criteria  are  difficult  or  Impossible  to  apply  directly.  Such  data  as  do  exist  are 
summarized  and  Implications  for  possible  criteria  developed. 

The  second  issue  is  the  accumulation  of  lags  and  delays  resulting  when  stick  and  flexible  mode  sup¬ 
pression  filters,  high-frequency  actuation  dynamics,  computational  delays,  etc.,  are  combined.  These 
give  rise  to  a  net  effective  time  lag  or  delay  in  the  vehicle  dynamics  as  seen  by  the  pilot  which,  if 
excessive,  can  cause  serious  piloting  problems. 

The  third  example  focuses  on  some  of  the  peculiarities  associated  with  sampled,  as  contrasted  with 
continuous,  control. 


DfllOOOCTIOB 

A  great  deal  of  attention  has  recently  been  given  to  the  technological  ways  and  means  of  Improving 
aircraft  energy  efficiency  and  various  aspects  of  aircraft  performance-  A  leading  approach  has  been  the 
development  of  new  control  concepts  which  can  be  used  In  conjunction  with  aircraft  configuration  tailor¬ 
ing  to  achieve  the  features  desired.  The  key  to  success  has  been  the  reduction  to  operational  practice 
of  multiple-redundant,  fly-by-wlre  (or  light),  fall-operational  flight  control  systems. 

The  practical  acceptance  of  fall-operational  FCS  was  an  enormous  step  forward.  This  has  become 
commonplace  for  relatively  short-time  tasks,  such  as  autoland  (e.g..  Ref.  1  notes  that  by  1980  the 
Trident  had  made  more  than  50,000  ln-servlce  automatic  landings).  Then,  che  further  progress  of  tech¬ 
nology  for  multiple-redundant  fall-operational  systems  and  experience  In  many  operational  aircraft  have 
been  accompanied  by  ma^or  expansions  In  the  activities  which  can  be  accomplished  by  flight  control. 
These  Include  a  cornucopia  of  functions  Intended  to  permit  extensions  In  performance  envelopes  — 
longitudinal  and  lateral  stability  enhancement,  span  load  modification,  elastic  mode  suppression,  ride 
smoothing,  flutter  prevention,  envelope  llmltlng/stretchlng,  etc.  These  have  been  studied,  and  to  some 
extent  applied,  over  the  last  decade  and  ere  grouped  under  the  general  heading  of  active  control  tech¬ 
nology  (Refs.  1-8).  Military  and  space  applications  have  led  the  way,  although  the  National  Aeronautics 
and  Space  Administration  and  the  transport  aircraft  manufacturers  have  devoted  considerable  effort  to 
commercial  transport  applications,  primarily  In  an  attempt  to  reduce  direct  operating  costs  via  fuel  sav¬ 
ings  (e.g.,  Refs*  9-11). 

In  Its  most  modern  manifestations,  as  exemplified  by  the  Space  Shuttle  and  new  fighters  entering  the 
Inventory,  multiple  fall-operational  fly-by-wlre  flight  control  technology  provides  both  for  major  weight 
and  volume  reductions  and  performance  enhancements  In  the  primary  flight  control  system  elements  and  for 
optimization  of  the  basic  airframe.  The  airframe  performance  optimization  can  include  a  wide  variety  of 
properties  such  as  drag  reduction,  L/D  improvement,  maximum  usable  maneuverability ,  low  observabilities, 
longer  fatigue  life,  etc*  The  new  control  technology  permits  this  to  be  accomplished  without  some  of  the 
constraints  and  traditional  penalties  Imposed  by  stability  and  control  or  flying  quality  requirements. 
Indeed,  the  new  flight  control  technology  can  redress  stability  and  control  Imbalances  which  earlier 
would  have  been  considered  to  be  excessive,  while  at  the  same  time  provide  flying  quality  characteristics 
whl'.h  border  on  an  absolute  optimum  —  If  only  someone  could  define  what  that  Is!  Because  the  systems 
*k'e  of  very  high  Integrity  and  are  typically  arranged  to  be  multiple  fall-operative,  essentially  any 
imaginable  alrcraf t-alono  stability  deficiency  can  be  corrected  as  long  as  sufficient  control  power  Is 
available. 


In  some  respects,  however,  this  wonderful  new  technological  marriage  Is  not  an  unmlxed  blessing.  The 
obvious  handmaidens  associated  with  greater  complexity  and  cost  are  well  known  In  kind  If  not  fully 
appreciated  In  degree*  Other  unfavorable  aspects  are  more  subtle,  being  of  the  nature  of  side  effects 


which  accompany  the  favorable  major  effects.  Three  of  these  are  discussed  and  Illustrated  in  this  paper. 
They  are: 

Flight  Control/Aircraft  System  Dynamics 
and  Flying  Qualities 

Accumulation  of  Lags  and  Delays 
Digital  System  Peculiarities 

FLIGHT  COWTROL /AIRCRAFT  SYSTEM  DTKAMICS  AMD  FIT  IMG  QUALITIES 

Many  of  the  aircraft  performance  and  energy  efficiency  benefits  available  In  advanced  aircraft  are 
gained  at  the  expense  of  reduced  aircraft-alone  stability.  While  each  configuration  has  its  own  special 
considerations,  typically  the  optimized  aircraft-alone  longitudinal  dynamics  will  be  statically  unstable 
in  some  parts  of  the  flight  regime.  To  correct  the  stability  deficiencies  a  number  of  feedback  system 
architectures  are  possible,  although  all  share  certain  properties.  In  the  discussion  below  a  partlcu- 
laily  simple  system  la  selected  as  a  representative  example.  The  characteristics  of  the  aircraft/ 
augmentation  system  are  developed,  idealized  as  a  "superaugmented"  aircraft,  and  then  contrasted  with  the 
characteristics  of  a  conventional  statically  stable  aircraft.  This  comparison  will  show  that  a  properly 
designed  augmeneor  can  result  in  attitude  response  characteristics  which  are  Identical  In  form  to  those 
of  the  conventional  aircraft  short  period  mode.  But,  the  parameters  which  govern  the  conventional  and 
superaugmented  responses  are  entirely  different  In  their  origin  and  may  be  slgnlf lrantly  different  In 
their  quantitative  values.  Fundamentally  this  Is  due  to  the  displacement  of  aircraft  stability  and 
control  parameters  by  some  equally  fundamental  control  system  parameters  as  the  dominant  entitles  In  the 
responses. 

For  normally  augmented  statically  stable  airplanes  the  effective  aircraft  characteristics  may  still 
be  close  enough  to  conventional  for  one  to  stretch  existing  flying  quality  criteria  using  such  concepts 
as  "equivalent  systems."  Por  superaugmented  aircraft,  on  the  other  hand,  such  extensions  may  not  be 
possible  or  pertinent.  This  brings  new  flying  qualities  considerations,  and  hence  new  PCS  specification 
possibilities,  to  the  fore. 

To  provide  a  context  for  comparing  some  of  the  conventional/auperaugmentatlon  differences,  attention 
la  focused  on  high  workload  pllot/alrcraf t  control  operations  as  the  central  flying  qualities  Issue. 
With  this  orientation  precision  path  control  Is  put  forth  as  the  key  control  task  to  explore* 

The  exploration  starts  with  a  summary  of  the  fundamental  flying  quality  differences  between  superaug¬ 
mented  and  conventional  aircraft,  within  the  path  control  context.  These  differences  are  then  examined 
for  their  consequences  viewed  in  the  light  of  existing  data.  Exemplary  sets  of  response  boundaries  for 
relaxed  static  stability  (RSS)  aircraft  are  used  aa  "atrawmen"  backdrops  for  comparing  pertinent  conven¬ 
tional  and  superaugmented  system  data.  The  comparisons  made  show  that  superaugmented  aircraft  are 
fundamentally  different,  and  that  new  FCS  criteria  and  flying  quality  data  are  needed.  Finally,  some 
partial  and  tentative  suggestions  for  PCS  specification  are  advanced  as  Interim  measures. 

An  Exemplary  FCS  to  Correct  KSS  Aircraft  Stability  Deficiencies 

Relaxed  static  stability  (near  neutral  or  unstable  static  margins)  la  perhaps  the  most  ubiquitous 
feature  of  advanced  aircraft  which  are  optimized  aa  composite  flight  control /air frame  systems.  To  cor¬ 
rect  the  consequent  reduced  short-period  damping  and  low  undamped  natural  frequency  or  short-period 
divergence,  and,  at  the  same  time,  significantly  Improve  the  aircraft  flying  qualities  and  reduce  pilot 
workload,  a  variety  of  full-authority  FCS  systems  can  be  constructed.  The  system  finally  selected  for  s 
particular  application  will  depend  on  many  considerations  and  tradeoffs.  Problems  of  Instrumentation  and 
sensing.  Including  biases  and  sensor  excitation  by  disturbances,  control  system  compensation  needed  for 
flight  condition  changes,  etc.,  must  enter  Into  comparative  consideration  of  practical  systems.  The 
transition  from  one  flight  phase  to  another,  the  effective  dynamics  presented  to  the  pilot,  and  the 
response  of  the  augmented  aircraft  to  external  disturbances  are  also  affected  by  the  particular  feedbacks 
chosen  and  must  be  considered  In  fundamental  comparisons  of  candidate  systems.  These  features  and  the 
consequences  on  effective  aircraft  dynamics  of  many  candidate  feedback  control  possibilities  are  treated 
In  detail  In,  for  example.  Ref.  12. 

To  permit  the  development  of  some  flying  quality  Issues  a  typical  example  of  an  FCS  suitable  for  RSS 
aircraft  Is  posed  here*  The  Issues  drawn  will,  of  course,  pertain  explicitly  only  to  the  example  system, 
although  aome  can  be  generalized  for  other  system  possibilities.  The  flight  control  system  selected  la 
shown  In  Fig.  1.  This  system  performs  six  functions,  as  follows: 

•  Creates  a  high  degree  of  effective  static  stability  for  the  augmented  aircraft. 

•  Improves  the  damping  of  the  effective  short-period  mode. 

•  Eliminates  the  phugotd  as  s  long  period,  lowly  damped  oscillation. 

•  Provides  a  pitch  rate  command /attitude  hold  platform  for  piloted  control* 

•  Regulates  against  external  disturbances,  with  emphasis  on  pitch  attitude  maintenance 
rather  than  weathercocklng. 

•  Provides  automatic  up-elevator  compensation  for  turning  flight. 

Aa  a  flight-critical  system,  all  the  system  elements  except  possibly  those  involved  In  turn  compensation 
would  be  multiply  redundant.  This  la  one  reason  for  basing  the  system  on  pitch  rate  sensors  which  are 
simple,  hardy,  ralatlvely  Insensitive  to  bias  errors,  and  easily  made  part  of  a  minimum  complexity 
multiple-redundant  system.  With  skewed  sensors,  for  Instance,  six  rata  gyros  oriented  so  that  their 
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Figure  1*  Typical  Pitch  SAS  for  Highly  Augmented  Aircraft 

input  axes  are  perpendicular  to  the  facea  of  a  dodecahedron  can  provide  dual  fail-operate  capability  for 
rates  in  all  three  axes. 

The  basic  low-frequency  control  law  for  the  Fig.  1  FCS,  which  drives  the  elevator  servo  with  a  signal 
proportional  to  pitch  rate  error,  qe»  and  the  Integral  of  pitch  rate  error,  qe/s,  is  simply: 

5  "  EqQe  *  ^  3e  -  (D 

Consequently ,  the  augmentor  as  a  stabilizer  creates  a  pitching  moment  proportional  to  /q  dt  and  one 
proportional  to  q.  The  first  term  creates  an  effective  derivative  Mr  (akin  to  Mg )  which  corrects  for 
the  static  instability,  damps  the  phugoid,  etc.,  while  the  second '  ?erm  augments  the  pitch  damping 
derivative,  M .  When  the  aircraft-alone  dynamics  Include  a  divergence,  the  alrcraft/FCS  combination  will 
be  a  conditionally  stable  system*  That  is,  a  minimum  gain,  K  ,  la  needed  to  rid  the  system  of  any 
divergence  due  to  the  aircraft-alone  static  instability.  At  the  Other  extreme,  the  maximum  gain  possible 
is  set  by  the  closed-loop  system  stability  limits.  If  the  aircraft  is  considered  only  as  a  rigid  body, 
these  limits  will  depend  primarily  on  the  high-frequency  lags  due  to  the  actuator,  rate  sensor,  and  other 
computational  or  filter  dynamics  within  the  closed-loop  system.  When  aircraft  flexible  mode  properties 
are  also  included,  they  too  will  also  affect  the  closed-loop  system  stability  and  maximum  gain.  For  the 
moment  all  the  higher  frequency  lags  will  be  neglected. 

When  the  saturation  characteristics  of  the  aircraft  control  surface  (and  surface  rates)  are  taken 
into  account,  the  maximum  gain  may  be  further  restricted.  The  higher  the  open-loop  gain,  K  ,  of  the  aug¬ 
mentor,  the  smaller  the  pitching  velocity  error  needed  to  saturate  the  control.  The  pilot  command  input 
can  be  deliberately  limited  to  avoid  saturating  the  controls,  but  external  disturbances  cannot.  Indeed, 
the  possibility  of  control  saturation  due  to  shears  and  other  atmospheric  disturbances  is  one  reason  for 
the  selection  of  the  Fig.  1  system.  Some  competing  stabilization  possibilities  result  in  systems  which 
are  not  as  tolerant  to  external  disturbances  and  which,  therefore,  cause  significantly  higher  probabili¬ 
ties  of  limiting  elevator  positions* 

Although  this  particular  exemplary  system  has  many  advantages  and  has  been  used  on  a  number  of  air¬ 
craft  (e.g.,  the  Space  Shuttle  Orbiter  and  some  modern  fighters),  it  has  its  own  peculiarities-  For 
instance,  the  presence  of  the  forward  loop  Integrator,  while  needed  for  either  a  pitch  rate  or  normal 
acceleration  system  to  accomplish  the  static  stability  function,  can  be  troublesome  in  some  flight  phases 
involving  transient  changes  in  trim  conditions  (e.g.,  takeoff)  if  not  properly  accounted  for  by  using 
appropriate  synchronizers  or  f light-phase-tailored  functional  modes.  On  the  other  hand,  this  system  is 
the  simplest  one  available  which  accomplishes  the  functions  listed  above.  It  was  actually  selected  for 
an  example,  however,  because  it  serves  as  an  excellent  paradigm  and  point  of  departure  for  developing  the 
types  of  flying  qualities  Issues  Involved  In  heavily  augmented  RSS  aircraft. 

The  changes  in  the  linear  dynamics  of  an  unstable  aircraft  due  to  the  control  system  will  be  illus¬ 
trated  below  using  a  system  survey  of  the  closed-loop  system.  This  survey,  given  in  Fig.  2,  consists  of 
a  number  of  complementary  root  locus  and  frequency  response  plots.  The  aircraft  dynamics  considered  are 
those  of  a  generic  RSS  transport,  with  numerical  values  which  represent  a  cruise  condition  with  a  5  per¬ 
cent  negative  static  margin  (Ref.  13). 


Figure  2a  is  a  conventional  s-plane  root  locua  which  shows  the  closed-loop  roots  of  the  system  as 
control  system  gain,  R  ,  is  Increased.  The  starting  points  are  the  poles  of  the  airplane  located  at 
-1/T a-  (located  in  the  right  half  of  the  s-plane,  indicating  its  character  as  a  divergence),  -1/Tgp.  (°n 
the  real  axis  in  the  left  half  plane),  and  the  phugoid  [Cp,  <*>p)  (a  lightly  damped  complex  pair  near  the 
origin).  The  control  system  also  has  a  pole  at  «  ■  0  due  to  the  integrator.  This  Is  not  shown  on  the 
plots  because  It  exactly  cancels  a  free  s  in  the  numerator  of  the  airplane  pitch  rate  due  to  elevator 
deflection,  q/6 ,  transfer  function.  As  the  controller  gain,  K_,  Is  Increased,  the  corrective  moments 
applied  to  the  airplane  by  the  elevator  modify  the  poles  of  the  closed-loop  system.  Some  of  these  at 
very  high  gain  approach  the  zeros  of  the  open-loop  system.  There  are  three  open-loop  zeros  in  the  Fig.  1 
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Figure  2.  System  Survey  for  Example  RSS  Aircraft /Augmentation  System  Dynamics  (Cruise,  Static 
Margin  -  -5Z  c;  q,  /q  dt  ♦  6  Closure,  1/Tq  -  2.0,  Ref.  13) 

augmentor.  Two  are  airplane  characteristics,  located  at  -l/Tg .,  In  the  left  half  plane  but  very  near  the 
origin,  and  at  -l/Tg.,  well  out  the  real  axis  In  the  left  hair  plane.  The  control  system  lead  time  con¬ 
stant,  T^,  la  shown  in  Fig.  2a  as  the  zero  at  -1/Tq. 

The  perambulations  of  the  closed-loop  roots  as  controller  gain  varies,  while  nicely  depicted  on  the 
s-plane  root  locus,  can  also  be  shown  with  controller  gain  and  associated  quantities  as  an  ordinate, 
rather  than  as  a  parameter  along  the  plot.  This  Is  accomplished  with  the  so-called  Bode  root  locus.  It 
uses  semi-log  presentations  for  conventional  open-loop  system  frequency  response  (Jw-Bode  plot  of  ampli¬ 
tude  ratio  and  phase)  and  Bode  root  locus  constructions  (root  loci  with  Bode  format),  wherein  gain  is  an 
Independent  variable  on  the  plot.  Figure  2  presents  these  diagrams.  The  ordinate  is  an  amplitude  ratio 
plot  of  the  open-loop  transfer  function  expressed  In  decibels,  while  the  abscissa  Is  a  logarithmic  scale 
of  several  general  "frequencies."  When  the  plot  Is  a  conventional  Bode  frequency  response  plot,  the 
"frequency"  Is  a  real  one,  <*>  in  rad/eec.  Complex  components  of  the  root  locus  use  undamped  natural  fre¬ 
quencies,  |s|  or  u»n,  in  rad/sec.  Finally,  real  roots  are  also  shown  here  as  o,  with  units  of  l/sec. 
Thus,  interpretation  of  the  abscissa  depends  on  the  particular  curve,  and  ia  either  «,  J#J,  or  o. 

The  conventional  Jw  Bode  diagram  consists  of  separate  amplitude  ratio  and  phase  plots  for  the  total 
open-loop  transfer  function  with  s  •  jw.  The  Jw  amplitude  ratio,  and  its  asymptotes,  and  phase  angles 
are  shown  in  Fig.  2.  The  breakpoints  on  the  asymptotic  plot  apply  to  all  the  Bode  plot  forms  and  occur 
at  values  of  "frsquency"  equal  to  magnitudes  of  the  open- loop  poles  and  zeros. 

Following  the  loci  of  Fig.  2a,  b  as  gain  Is  Increased  the  various  airplane  modes  are  modified  as 
follows: 

1)  The  airplane  short-period  divergence,  l/Tapj*  1*  decreased  as  gain,  K-,  la  increased; 
bacomaa  stabilised  as  it  passes  through  the  jw-axls;  and  finally  terminates  on  the  sir- 
plane  tero  at  -1/Tgj  as  gain  approaches  Infinity. 

2)  The  short-period  subsidence,  with  time  constant  TBp.,  proceeds  along  the  real  axis  to 
ths  right  toward  -l/Tg  .  Part  of  the  damping  given  up  by  this  subsidence  Is  transferred 
as  an  increase  in  damping  to  the  divergence. 


3)  The  phugoid,  which  for  the  airplane-alone  is  stable  but  lightly  damped  (;„  -  0.152),  is 
initially  driven  toward  instability  as  the  augmentor  gain  is  increased.  For  controller 
gains  0.004  <  <  0.06  deg/deg/sec  the  closed-loop  phugoid  is  unstable.  This  is  the 

portion  of  the  locus  depicted  with  C  O  O  .  For  gains  greater  than  this  the  phugoid  is 

stable  and  the  nearly  circular  arc  of  Fig.  2a  corresponds  to  the  nearly  constant  slope 

Oi  40  dB/decade  on  the  Bode  root  locus  in  Fig.  2b.  This  arc  is  nearly  centered  on  the 
control  system  at  -1/Tq.  Also,  the  radiua  of  the  nearly  circular  segment  is  approxi¬ 
mately  1 1 /Tq I  *  4s  gain  is  Increased  further,  the  undamped  natural  frequency,  damping, 
and  damping  ratio  of  this  quadratic  mode  increases  until  ultimately  Cp  •  1  when  the  arc 

hits  the  real  axis.  The  undamped  natural  frequency  of  this  critically  damped  mode  is 

just  slightly  less  than  2/T  .  The  real  axis  is  encountered  for  a  gain  of  approximately 
K  -  3.88,  after  which  the  complex  roota  divide  into  two  real  roots.  One,  as  is  shown 
on  both  the  Fig.  2  plots,  goes  into  the  1/T^  control  system  lead,  while  the  other  pro¬ 
gresses  indefinitely  out  the  high-frequency  asymptote. 


The  system  with  Kq  -  1.06  reflects  several  different  good  control  system  design,  response,  and  sta¬ 
bility  considerations.  These  include: 


•  Responses  which  are  similar  to  those  of  low-order,  well-damped,  rapidly  responding  sys¬ 
tems.  This  implies  that  the  low-frequency  open-loop  polea  are,  in  their  cloeed-loop 
manifestations,  driven  nearly  into  open-loop  zeros,  such  that  they  nearly  cancel.  Exam¬ 
ples  on  Fig.  2  for  the  K  -  1.06  reference  0  dB  line  are  the  close  proximity  of  the  lead 
at  1/Tq.  with  the  closedf-loop  pole,  shown  as  |,  stemming  from  the  divergence,  and  a 
similar  proximity  of  the  lead  at  1/Tq  to  the  pole  arising  from  the  short-period  subsi¬ 
dence.  It  also  implies  a  well-damped  dominant  mode,  as  given  by  the  quadratic 
[Cp,  -  10.59,  1.92]. 


Insensitivity  of  the  response  to  gain  changes.  This  is  Illustrated  by  the  nearly  verti¬ 
cal  slopes  of  the  loci  in  Fig.  2b  as  they  drive  into  1/Tq  and  1/Tq-  around  the  refer¬ 
ence  crossover  region.  Because  the  slopes  are  so  steep  small  changes  in  gain,  or  for 


that  matter  small  changes  in  the  open-loop  aerodynamics  which  change  1/Tq,  and  I/Tq.. 
will  not  materially  affect  the  near  cancellation  of  these  closed-loop  leaab  and  lags. 


Thus,  such  shifts  will  hardly  effect  any  changes  in  the  response. 


•  System  stability  with  large  stability  margins.  In  the  present  example  of  the  condi¬ 
tionally  stable  system,  a  margin  of  19  dB  exists  on  the  low-gain  end  relative  to  the 
reference  -  1.06.  Thus,  nearly  a  factor  of  10  in  gain  reduction  would  be  needed  to 

get  back  to  the  divergence.  At  the  high-frequency  end,  the  crossover  of  uc  ■  2  rad/sec 
(which  Incidentally  sets  the  desired  controller  gain  at  -  1.06)  Is  consistent  with  - 
phase  margin,  ^m*  of  50  deg  and  a  delay  margin,  tM,  of  0.44  sec.  Thus,  high  frequency 
lags  or  parameter  uncertainties  currently  ignored  in  the  design  would  have  to  contribute 
50  deg  of  phase  lag,  or  the  equivalent  of  a  pure  time  a^lay  of  0.44  sec,  before  the 
closed-loop  system  would  be  neutrally  stable  at  the  gain  selected. 


•  Well  damped  and  rapidly  responding  closed-loop  system  dominant  aode(a)  to  resist  and 
thereby  reduce  the  effects  of  disturbances.  In  the  present  example  the  dominant  mode  la 
the  oscillation  stemlng  from  the  phugoid  which,  for  the  nominal  controller  gain,  has  a 
damping  ratio  of  0.59  and  an  undamped  natural  frequency  of  1.92  rad/sec.  This  mode  la 
therefore  both  stiff  and  well  damped* 


•  Closed-loop  system  bandwidth  which  is  sufficiently  large  that  the  augmented  airplane  la 
responsive  to  pilot  conmwnd  without  requiring  pilot  anticipation  or  compensation  for 
precision  control.  In  the  present  case  the  system  as  seen  by  the  pilot  is  rate-comnand 
with  a  bandwidth  near  the  crossover  frequency  of  2  rad/sec. 


•  The  control  system  gain  should  be  low  enough  so  that  th-  augmentor  Is  very  seldom  satur¬ 
ated.  Saturation  may  be  viewed  as  reducing  the  get',  end  thus  progressing  from  the 
nominal  0  dB  line  closed-loop  roots  back  towsrd  those  of  the  open-loop  aircraft .  When 
completely  saturated,  the  effective  controller  gain  approaches  zero  and  the  effective 
aircraft  dynamics  are  those  of  the  airplane  alone.  Unfortunately,  in  this  event  the 
pilot  also  has  no  control  available  in  one  direction,  since  the  surfaces  are  saturated. 
These  kinds  of  considerations  are  easy  to  show  on  the  plot  of  Fig.  2  ee  commanded  pitch¬ 
ing  velocities  which  would  just  saturate  the  system  when  gains  are  set  at  particular 
levels.  Scales  showing  the  maximum  pitching  velocity  commendable  without  saturation,  q0 
max.  Is  given  on  the  right  side  of  the  Bode  root  locus  plot  next  to  that  for  the  con¬ 
troller  gain,  K_ ,  In  linear  units.  Another  useful  scale  for  partial  saturation  and 
other  low-gain  operations  la  given  on  the  far  left  side.  This  shows  the  time  to  double 
amplitude  of  the  divergent  root  at  the  several  gain  levels  (In  essence  this  la  a  cross- 
plot  of  the  locus  from  1/T8p2  toward  the  1/Tq.  lead).  For  Instance,  a  divergence  with 
6  sec  time  to  double  amplitude  corresponds  to1  a  gain  K  of  0.010  deg/deg/sec •  This  Is 
an  enormous  reduction  In  effective  loop  gain  (factor  of  388)  In  terms  of  saturation  or 
other  gain  reduction  phenomena,  showing  that  the  system  Is  quite  robust  at  the  nominal 
value  of  Kq  ■  1.06. 


The  description  above,  even  though  of  a  suanary  overview  character,  may  appear  tedious.  The  net 
effect,  however,  of  a  well-tempered  design  is  straightforward.  It  is  that  the  closed-loop  pitching 
velocity  response  to  a  step  input  will  have  the  approximate  form: 


*The  prime  on  Cp  Indicates  it  is  a  closed-loop  damping  ratio  of  a  quadratic  mode  %dilch  started,  at 
zero  gain,  from  the  phugoid  Cp, 


_ [T„»  +  l) _ 
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The  4  and  «>n  in  the  denominator  are  thoae  of  the  closed- 
loop  oscillatory  mode  which  progressed  from  the  phugold, 
while  the  lead  time  constant.  T  ,  is  the  controller  lead. 
The  approximation  takes  advantage  of  the  fact  that  the 
ahort-perlod  subsidence  and  divergence  are  both  modified 
by  the  effects  of  feedback  control  and,  for  favored 
gains,  do  not  even  appear  In  the  pitching  velocity 
response  since  they  are  nearly  cancelled  by  the  airplane 
leads  at  1/Tg.  and  l/Tg„.  Feedback  control  has  thus  pro¬ 
vided  ua  with  a  low-order  effective  system  as  far  as 
pitch  attitude  response  to  pilot  inputs  is  concerned*  It 
Is  in  fact  identical  in  form  to  that  of  the  short  period 
of  a  statically  stable  conventional  airplane*  This  is 
especially  apparent  in  the  time  response  for  the  total 
system  shown  in  Fig.  3a.  There  the  characteristic  ini¬ 
tial  ramp-like,  nearly  constant  pitch  acceleration  rise 
with  the  overshoot  end  subsequent  return  looks  very  simi¬ 
lar  to  the  exemplary  time  response  of  Fig.  3b  for  a  con¬ 
ventional  aircraft  with  a  large  static  margin. 

There  is  an  important  difference  between  the  time 
responses  of  Figs.  3a  and  3b  in  that  the  closed-loop  sys¬ 
tem  response  for  Fig.  3a  la  that  for  all  time  rather  than 
Just  the  first  few  seconds.  For  the  conventional  air¬ 
craft  the  Fig.  3b  response  will  be  succeeded  by  the 
phugold  long  period  oscillation. 


a)  Augmer'ed  A 'nr of'  Attitude  y  Cruise  F  :-gh * 


In  Fig.  3  the  pitching  velocity,  q,  for  a  step  eleva¬ 
tor  is  given  in  normalized  form,  scaled  by  the  steady- 
state  pitching  velocity,  qgg.  The  time  scale  in  Fig.  3b 
is  non-dimensionalized  using  u>gpt  as  the  time  variable. 
Notice  that  the  non-dimensionalized  rise  time,  w#pTR, 
depends  only  on  the  product  of  the  lead  time  constant, 
Tg  2»  and  the  short-period  undamped  natural  frequency, 
wgp.  Interestingly  enough,  the  peak  overshoot  also 
depends  only  on  this  product  and  the  damping  ratio,  C8p. 
Figure  4a  (Ref.  14)  shows  this  oversnoot  as  a  function  of 
the  Tg  2^  ap  product,  with  4ap  as  a  parameter.  Because  of 
the  (Tg.s  +  1)  lead  in  q/qaa,  there  is  an  overshoot  even 
when  tne  damping  ratio  is  critical  (4ap  -  1).  For 


nominal  well-damped 


overshoot  depends  as 
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b)  Short  Period  Attitude  OyoanKs  for  o  Convert to*ai 
Aircraft  With  Large  $tot>c  Stability 


Figure  3.  Pitch  Rate  Response  for  Step 
Control  Surface  Input 


much  on  the  separation  between  1/Tg.  and  wap  as  it  does  on  4ap.  1  /Tg .,  being  dependent  on  the  lift 
curve  slope,  C^,  as  scaled  by  speed  and  density,  is  an  aircraft  parametef  set  mainly  by  wing  configura¬ 
tion,  whereas  wgp  can  be  adjusted  by  shifting  the  aircraft's  balance,  l.e.,  the  c.g.  location.  The  more 
forward  the  c.g.,  the  greater  the  weathercock  stability,  and  the  stlffer  the  short  period  mode;  hence, 
from  Fig.  4a,  the  greater  the  overshoot  (for  a  given  1/Tg.  and  4ap).  Similarly,  the  rise  time  decreases 
as  the  short-period  undamped  natural  frequency  is  increased*  Rise  time  is  given  approximately  by: 


Lift  curve  slope  and  rise  time  thus  vary  together,  as  does  the  peak  overshoot  for  a  fixed  wgp. 

In  the  exemplary  case  study  for  the  highly  augmented  RSS  aircraft,  pitch  attitude  response  lead,  T  , 
came  from  the  augmentor  lead  rather  than  from  the  airplane  Tg..  In  fact,  the  airplane  pitch  attitude 
lead,  Tg.,  is  not  even  present  in  the  pitch  rste  response,  since  it  was  essentially  canceled  by  the 
closed-loop  subsidence  originating  at  1/Tapj,.  Also,  the  undamped  natural  frequency  and  damping,  while 
superficially  similar  to  the  short  period,  depend  Instead  primarily  upon  the  control  system  lead  time 
constant,  T  (which  set  the  circular  arc  along  which  the  4p,  «p  closed-loop  roots  proceeded),  and  the 
total  open  loop  gain,  KqMg,  which  located  4p»  <i>p  at  a  given  spot  along  this  arc.  These  parameters  are 
associated  predominantly  with  the  highest  frequency  and  next  highest  frequency  asymptotes  of  the  Fig.  2b 
Bode  diagram.  Using  Just  these  two  high  frequency  asymptotes  as  an  approximation  for  the  total  system, 
It  Is  easy  to  show  that  the  approximate  values  of  u>n  and  4  are  given  by: 


T  (which  set  the  circular  arc  along  which  the  4p,  «p  closed-loop  roots  proceeded),  and  the 
n  loop  gain,  KqMg,  which  located  4p»  at  a  given  spot  along  this  arc.  These  parameters  are 
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Also,  the  approximate  normalized  rise  time  is 


(6) 
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Here  the  quantity  u >ca  -  Is  the  croeaover 
frequency  of  the  0  dB  line  with  the  high- 
frequency  asymptote.  The  subscript  "a”  dis¬ 
tinguishes  It  from  the  crossover  frequency  we, 
which  Is  based  on  the  value  where  the  open-loop 
Jw-Bode  amplitude  ratio  crosses  the  0  dB  line. 

The  Halting  case  heavily  augmented  RSS  air¬ 
craft  In  which  the  airplane  pitch  attitude  lead 
Tq  no  longer  appears  in  the  effective  augmented 
aircraft  pitch  dynamics  la  referred  to  here  as 
"auperaugmented".  The  supers ugmen ted  distinc¬ 
tion  Is  made  to  highlight  that  auperaugmented 
aircraft  have  attitude  characteristics  which 
depend  primarily  on  the  crossover  frequency, 
<*»ca  "  «  and  the  controller  lead  T  ,  and  that 
these  characteristics  may  differ  lnq  kind  from 
those  of  even  fairly  heavily  augmented  conven¬ 
tional  craft*  In  this  sense,  auperaugmented 
aircraft  are  an  idealization  which  may  not 
always  be  approached  by  heavily  augmented  air¬ 
craft.  On  the  other  hand,  the  Space  Shuttle  la 
an  Ideal  example  of  a  auperaugmented  aircraft, 
for  l/Tfl^  1®  completely  suppressed  In  Its  pitch 
attitude  response  and  is  replaced  by  a  control 
system  lead.  Super augmentation  Is  a  useful  con¬ 
cept  because  It  Is  sufficiently  Idealized  to 
simplify  the  drawing  of  Issues  and  understand¬ 
ing,  while  not  so  far  removed  from  reality  as  to 
make  the  considerations  academic. 

By  way  of  comparison  of  the  key  pitch  atti¬ 
tude  response  parameters.  Table  1  summarizes  the 
attitude  lead  and  quadratic  mode  characteristics 
of  q/qa8  for  a  conventional  aircraft  short 
period  and  for  an  Idealized  auperaugmented 
aircraft. 
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Figure  4,  Maximum  Pitch  Rate  Overshoot  Variation 


TABLE  1.  COMPARISON  OP  PITCH  ATTITUDE  RESPONSE  GOVERNING  PARAMETERS  FOR 
CONVENTIONAL  AND  SUPERAUGMENTED  AIRCRAFT 
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For  the  conventional  airplane,  covered  at  the  left,  th*  table  reiterates  that  the  attitude  lead  and 
short-period  undamped  natural  frequency,  and  hence  the  rise  time,  depend  primarily  on  aircraft  configura¬ 
tion  characteristics  and  the  way  the  aircraft  la  balanced.  The  damping  ratio  also  la  predominantly  a 
function  of  configuration,  although  a  pitch  damper  can  provide  a  good  deal  of  design  latitude. 

For  the  superaugmented  aircraft,  the  dlscuaalon  of  the  example  emphasized  the  relative  lack  of  sensi¬ 
tivity  to  aircraft  configuration  characteristics  and  the  relative  importance  of  Che  controller  propert lea 
as  they  affect  Che  closed-loop  aircraft /augmenter  system.  The  primary  design  factors  described  there 
were  considerations  of  a  closed-loop  character.  Including  the  system  stability,  response,  bandwidth,  sta¬ 
bility  margins,  etc*  The  moat  Important  composite  factor  underlying  the  dynamlra  of  the  superaugmented 
vehicle  la  the  crossover  frequency  (of  the  asymptote),  This  quantity  la  an  indication  of: 

•  The  total  system  gain  comprising  both  controller  (K^)  and  aircraft  control  effective¬ 
ness  (H5)  parameters. 

•  The  system  bandwidth,  which  Indicates  the  frequency  range  of  good  errand  following  *nd 
disturbance  suppression* 

•  The  rapidity  of  system  response,  l«e.»  rise  time  Tp  -  l/u»r-. 

•  The  system  damping  ratio.  In  that  <*cm  la  a  key  factor  (together  with  the  controller  lead 
time  constant,  T^)  in  setting  the  damping  ratio,  c. 

The  first  three  properties  of  the  crossover  frequency  listed  abeve  are  qualitatively  applicable  to  all 
feedback  control  systems  which  have  a  low-paaa  closed-loop  character*  The  fourth  property  la  a  special 
one  for  superaugmented  systems  which  sljsre  the  specific  characteristics  of  the  example  case.  It  la  one 
reflection  of  the  idealized  superaugmented  situation  wherein  only  two  parameters,  the  attitude  lead  (T  ) 
and  crossover  frequency  (u>ca),  define  all  the  system  Input/output  characteristics  except  the  overall 
response  scaling  between  output  and  Input. 

Another  manifestation  of  the  two-parameter  character  of  the  Idealized  superaugmented  aircraft  can  be 
seen  In  connection  with  the  maximum  pitch  rate  overshoot.  The  euper augmented  version  of  Fig.  4  is  ehown 

In  Fig*  4b.  The  possible  variation  In  damping  ratio,  overshoot,  and  normalized  rlaa  time  la  encompassed 

by  the  straight  line  superimposed  on  the  background  plot.  Notice  that  for  a  normalized  rise  time  of  1, 
the  damping  ratio  Is  0.5  and  the  undamped  natural  frequency  la  1/T  -  At  the  other  end  la  a  normalized 
rise  time  of  0.5,  accompanied  by  a  (  ■  1  and  an  wn  ■  2/T^.  Any  system  between  these  two  extremes  has 
excellent  closed-loop  control,  system  stability,  and  margins.  Again  the  parameters  which  set  the  actual 
location  on  the  attainable  line  are  the  crossover  frequency,  wc  ,  and  the  control  system  lead  tlmt  con¬ 
stant,  T  .  * 

q 

A  major  distinction  can  also  be  made  between  the  superaugmented  and  conventional  aircraft  with  rafer- 
ence  to  the  aerodynamic  characteristics  which  underlie  their  responses.  For  the  conventional  aircraft, 

even  in  the  short  period,  the  stability  derivatives  2  -  M  ,  and  Mq  together  with  their  variations  with 

flight  condition,  are  major  governing  parameters.  VJhen  the  complete  three-degree-of-f reedom  airplane 
characteristics  are  also  taken  into  account,  several  more  derivatives  become  Important  (a.g.,  Z (J,  My, 
etc.).  In  contrast,  to  the  extent  that  the  system  can  be  made  to  approach  the  superaugmented  character¬ 
istics,  the  aerodynamic  parameters  of  importance  reduce  to  the  surface  effectiveness,  • 

Precision  Path  Control 

Those  aircraft  control  functions  which  demand  the  greatest  pilot  attention  and  skill  require  primary 
consideration  In  flying  qualities  assessments.  Probably  the  moat  demanding  high  workload  pllot/alrcraft 
closed-loop  control  operations  Involve  precision  path  control  In  unfavorable  environmental  conditions. 
All  flight  phases  require  some  form  of  path  control,  which  incorporates  both  flight  path  changes  and 
flight  path  maintenance  or  regulation*  In  most  ordinary  flight  circumstances  path  control,  while  an 
essential  pilot  skill,  la  nonetheless  a  relatively  benign  and  low-stress  function.  On  the  other  hand, 

when  the  path  task  ta  Itself  very  demanding  and  the  environment  unfavorable  (e«g»,  low  visibility 

approach  and  landing  In  turbulence  and  shear),  the  precision  path  control  task  becomes  exceedingly  exact¬ 
ing.  Thus  precision  path  control  Is  used  here  as  the  control  teak  to  explore  the  effects  of  heavy 
augmentation  on  closed-loop  pllot/alrcraft  system  flying  qualities* 

A  block  diagram  that  indicates  the  pilot's  activities  In  precision  path  control  la  shown  In  Fig.  5. 
On  the  right  the  augmented  aircraft  has  path  deviation  and  pitch  attitude  as  the  output  variables 
stealing  from  aircraft  dynamics  which  are  forced  by  external  atmospheric  disturbances  and  the  pilot  con¬ 
trol  output,  5.  The  augmented  aircraft  Itself  la  a  closed-loop  system  comprising  the  airplane-alone  and 
augmentation  system.  Thus,  the  sensors,  computation,  and  actuation  elements  involved  In  the  feedback 
control  augmentation  system,  ee  well  as  the  aircraft  alone,  are  encompassed  by  the  "Augmented  Aircraft 
Pitch  Dynamics"  block  in  Fig.  5.  (An  underlying  assumption  In  this  diagram  la  that  other  aircraft  con¬ 
trol  effectors  such  as  throttle  or  flap  are  not  being  continuously  modulated  by  pilot  control  action; 

trim  management  using  these  aircraft  effectors,  however,  la  not  excluded.) 

Even  though  trimmed  precleely,  the  augmented  aircraft  will  not  by  itself  maintain  exactly  the  pre¬ 
scribed  path  and  attitude  in  the  presence  of  disturbances »  Consequently,  the  pilot  must  exert  control 
not  only  to  establish  the  desired  path  but  also  to  correct  any  deviations  from  the  desired  attitude  and 
path.  This  la  accomplished  by  the  pilot  ectlng  as  a  closed-loop  controller,  which  means  simply  that  the 
pilot's  control  output  la  dependent  on  (l«e.,  a  function  of)  path  deviation  and  attitude*  Thus,  a  com¬ 
ponent  of  the  pilot's  control  output  la  correlated  with  an  attitude  error,  and  another  component  la  cor¬ 
related  with  the  difference  between  the  desired  and  actual  path.  This  relationship  la  depleted  in  the 
Fig*  5  block  diagram  as  a  "aeries"  pilot  closure,  l.e.,  the  pilot's  action  on  path  deviation  acta  in 
series  with,  and  provides  an  internal  "attitude  command"  for,  the  pilot's  action  on  attitude  error. 
These  pilot  activities  are  represented  in  Fig.  5  by  the  symbolic  transfer  characteristics  Yp  and  YpQ. 
Several  research  studies  using  elaborate  and  detailed  measurements  of  just  this  situation  (e.g.n.  Refs.  15 
and  16)  Indicate  that  this  aeries  structure  and  general  pilot  behavior  control  model  la  appropriate  for 
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Figure  5*  Closed-Loop  Precision  Path  Control  with  Attitude  Control  Inner  Loop 


path  control  situations.  In  essence,  the  pilot's  higher-frequency  control  actions  are  devoted  primarily 
to  attitude  so  that  the  "Inner"  attitude  loop  Is  tightly  closed,  and  the  attitude  la  well  regulated. 
This  tight  inner  loop  makes  possible  the  effective  closure  of  the  "outer"  path  deviation  loop  without 
excessive  pilot  equalization  or  compensation.  Without  good  control  of  attitude  the  pilot  would  have  to 
be  way  ahead  of  any  path  changing  trends,  requiring  very  difficult  anticipation  and  high  workload. 
(Examples  Include  altitude  control  using  only  airspeed  and  altimeter  or  control  during  approach  using 
only  airspeed  and  the  raw  ILS  glldepath  data.)  If  the  attitude  loop  la  difficult  for  the  pilot  to  Inter¬ 
act  with  and  close  (i.e..  If  the  augmented  aircraft  pitch  attitude  dynamics  are  deficient  In  that  they 
require  excessive  pilot  compensation  and  attentional  workload),  attitude  control  will  suffer  directly  and 
path  control  Indirectly. 

It  will  evolve  below  that  a  key  Issue  in  the  differences  between  the  flying  qualities  of  convention¬ 
ally  augmented  aircraft  and  superaugmented  aircraft  resides  In  the  differences  In  the  transfer  character¬ 
istics  for  the  augmented  pitch  attitude  and  the  similarities  for  the  path/attltude  response.  By  focusing 
on  these  facets  we  can  expose  the  major  differences  between  heavy  and  conventional  augmentation  without 
an  elaborate  argument  Involving  the  pilot's  detailed  control  actions.  It  is  extremely  Important  to 
recognize,  however,  that  the  closed-loop  piloting  aspects  are  a  central  Issue  In  that  the  pilot's  assess¬ 
ment  of  the  suitability  of  the  aircraft  Inherently  depends  upon  his  actions  required  to  accomplish  con¬ 
trol.  (As  an  adaptive  controller  the  pilot  adjusts  his  control  actions  as  needed  to  compensate  for  the 
aircraft  dynamics;  so  different  aircraft  dynamics  meen  different  pilot  actions  and  different  pilot 
assessments.)  Thus,  the  feedback  loop  structure  and  what  the  pilot  actions  are  on  path  deviation  and 
attitude  are  of  central  concern  to  set  the  context  of  the  control  task.  Yet,  within  this  context,  one 
csn  focus  primarily  on  the  augmented  aircraft  pitch  dynamics  and  the  aircraft  path/attltude  response  to 
explore  differences  between  conventional  and  highly-augmented  aircraft. 

The  aircraft  blocks  in  Fig.  5  show  the  transfer  characteristics  in  fairly  general  form  for  the  pitch 
attitude  dynamics  and  for  the  path/attltude  response  dynamics.  The  time  constant  Tq  .  is  often  referred 
to  as  the  path/attltude  "lag"  time  constant.  This  stems  from  its  appearance  In  the  denominator  of  h/9 . 
For  a  step  pitch  attitude  change,  the  flight  path  angle,  Y,  or  the  rate  of  change  of  path  deviation,  fi, 
will  respond  exponentially,  with  the  time  lag  Tq_.  Because  1/Tq  -  -Zw,  which  in  turn  is  proportional 
to  the  lift  curve  slope  of  the  airplane,  Cj^,  this  path-to-attltude  time  lag  Is  a  direct  function  of  the 
fundamental  performance  characteristics  of  the  airplane.  Once  the  wing  Is  designed  (and  set  by  a 

given  wing  configuration),  Tq  for  a  given  flight  condition  cannot  be  changed  without  dlrect-llft  con¬ 

trol*  As  a  flight  path  lag  tq.  Is  an  extremely  Important  factor  In  the  attainable  path  precision  as  It 
limits  the  pilot's  outer  loop  control  bandwidth  even  If  the  pitch  attitude  dynamics  are  perfect.  This 
lag  and,  accordingly,  the  aircraft  path/attltude  response  block  In  Fig.  5  Is'  the  same  for  both  conven¬ 
tional  and  superaugmented  aircraft. 

Harked  differences  occur  in  the  Augmented  Aircraft  Pitch  Dynamics  block.  For  conventional  airplanes, 
the  lead  time  constant,  T,  In  Fig.  5  la  Tq  Thus  the  attitude  lead  and  the  path  lag  are  the  same  quant¬ 
ity,  fixed  by  the  same  aircraft  configuration  feature  (the  lift  curve  slope).  The  undamped  natural  fre¬ 
quency  and  damping  ratio  of  the  augmented  aircraft  pitch  dynamics  are,  In  this  case,  C  ■  C8p  and  <*>n  “ 

usp*  Consequently,  for  a  conventional  aircraft  the  pitch  and  path  dynamics  are  predominantly  dependent 
on  the  three  variables,  Tq_,  C8p,  and  u>8p,  which  In  turn  depend  on  the  lift  curve  slope,  the  weathercock 
stability,  and  the  pitch  damping.  For  the  superaugmented  aircraft  the  attitude  lead  Is  no  longer  Tq-, 
but  the  control  system  lead  T  ,  while  the  undamped  natural  frequency  and  damping  ratio  are  unrelated  to 
those  of  the  conventional  short  period.  Thus,  the  augmented  aircraft  pitch  attitude  dynamics  are  poten¬ 
tially  fundamentally  different  than  those  of  a  conventionally  augmented  aircraft. 

Hot  the  least  important  of  these  differences  is  the  replacement  of  the  Tq^  l«ad  by  T  ,  for  now  the 
attitude  lead  la  not  the  same  as  the  path/altitude  response  lag.  On  existing  superaugmented  vehicles, 
there  Is  often  a  substantial  difference  between  these  two  properties.  For  instance,  on  the  Shuttle 
Orblter,  In  a  typical  approach  flight  condition  the  value  of  1/Tq-  Is  about  0.54  sec”1  whereas  1/Tq  Is 
1.5  sec*1  (Ref.  17).  Similarly,  for  the  example  RSS  transport  In  cruise  1/Tq  la  0.46  sec”1  while  I/T 
is  2  sec”1.  q 
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Fund— n til  Vljrlot  Quality  CoiiwqueDccs 
for  Saperaagmented  Aircraft 

As  demonstrated  above  the  distinction  between  conventional  and  superaugmented  closed  loop  aircraft/ 
augmentation  system  dynamics  Is  present  In  the  pitch  attitude  characteristics  block.  Although  the  forms 
are  the  same,  the  parameters  are  different  in  both  the  numerator  lead  and  the  denominator  quadratic  which 
describes  the  aircraft's  high  frequency  (short-time)  attitude  response  characteristics.  In  review,  the 
key  distinctions  made  are: 

•  The  aircraft  path/attitude  response,  h/9,  is  the  same  for  both  conventional  and  super- 
augmented  aircraft; 

•  The  augmented  aircraft  pitch  attitude  short-term  characteristics  differ  In  that: 

1)  The  lead  Tg  for  the  conventional  aircraft  Is  the  same  as  the  path/sttltude 
lag,  whereas  the  lead  for  the  superaugmented  aircraft  Tq  may  be  quite  dif¬ 
ferent  from  T02» 

2)  The  undamped  natural  frequency  and  damping  of  the  effective  short-period  mode 
for  the  conventional  aircraft  depends  primarily  on  aircraft  flight  condition, 
weathercock  stability,  and  pitch  damping  (sometimes  augmented). 

3)  The  undamped  natural  frequency  and  damping  for  the  superaugmented  aircraft 
depends  predominantly  on  the  augmentation  system  (lead  and  g. in)  and  aircraft 
control  effectiveness  (M$)  parameters. 

•  The  low  frequency  and  trim  characteristics  for  the  conventional  aircraft  are  not 
reflected  by  the  short-period  attitude  dynamics  approximation,  whereas  the  superaug¬ 
mented  aircraft  pitch  attitude  dynamics  are  appropriate  for  low  frequency  and  trim. 

With  these  differences  now  established  as  at  least  Idealizations,  the  key  question  is  what  effect.  If 
any,  do  they  have  on  flying  qualities  and  hence  on  desirable  PCS  characteristics?  Unfortunately,  the 
answer  to  this  question  Is  not  yet  In.  A  resume  of  current  status  on  these  issues  will  be  given  below. 

At  the  outset  It  should  be  recognized  that  almost  all  of  the  criteria  and  the  very  great  preponder¬ 
ance  of  flying  quality  research  data  which  underlie  the  various  flying  quality  criteria  were  obtained  on 
aircraft  In  the  conventional  category.  The  flying  quality  data  base  for  heavily  augmented  and  superaug¬ 
mented  aircraft  is  exceedingly  sparse.  In  fact,  much  of  the  available  data  base  and  even  some  of  the 

relevant  criteria  In  the  existing  or  proposed  Military  Specification  (Refs.  18  and  19)  cannot  be  used 
directly  for  superaugmented  aircraft*  A  recently  completed  study  In  which  all  available  criteria  were 
considered  for  a  particular  superaugmented  aircraft  —  the  Space  Shuttle  Orblter  —  showed  that  they  were 
sometimes  Inapplicable  or  gave  very  ambiguous  and  confusing  results  (Ref.  17). 

One  of  the  pioneering  attempts  to  specify  the  flying  qualities  of  a  relaxed  static  stability  vehicle 
derives  from  the  Space  Shuttle  Orblter.  Because  this  vehicle  under  piloted  control  Is  always  an  "effec¬ 
tive  vehicle"  which  Inherently  Intermingles  airframe-alone  with  some  augmentation,  this  specification 
from  the  outset  considered  only  the  alrcrsft/FCS  closed-loop  system  charscterlstlcs.  The  Shuttle  flight 
control  system  is  flight  crucial,  so  no  attention  was  paid  to  Che  alrcraf t-alone  dynamics  in  the  require¬ 
ments.  The  specifications  also  relate  directly  to  the  pitch  attitude  control,  with  no  specific  mention 
to  path  control  features.  The  statements  are  given  In  two  parts.  The  first  part  la  qualitative  and 
states  that  the  system  shall  provide  a  pitch  rate  output  proportional  to  pilot  inputs.  This  Is  accomp¬ 
lished  using  an  augmentation  system  which  la  equivalent  to  the  example  used  here  (Fig.  1).  The  second 

part  is  more  quantitative  in  character  and  provides  limits  on  the  maximum  and  minimum  steady-state  pitch 
rates  that  can  be  commanded  and  a  time  domain  boundary  specification  for  transient  responses.  Only  the 
latter  is  of  Interest  here.  The  original  subsonic  pitch  rate  response  boundaries,  from  Ref.  20,  are 
ahown  in  Fig.  6.  These  boundaries  have  ahlfted  somewhat  dur  g  the  Shuttle's  development,  with  the 

present  (Ref.  21)  set  also  shown  In  Fig.  6.  The  third  set  of  boundaries  in  Fig.  6  are  rise  time  and 

settling  time  criteria  proposed  by  NLR  for  transport  aircraft  with  rate  command /attitude  hold  flight  con¬ 
trol  systems  (Ref.  22).  Their  definition  for  rise  time  differs  from  that  used  here.  It  Is 

Trlae  »  the  time  In  which  the  pitch  rate  response  to  a  step  type  control  Input  reaches  % 

90  percent  of  the  final  steady  state  value. 

The  NLR  Settling  time  la  the  time  after  which  the  pitch 
rate  response  remains  within  a  band  from  90  percent  to 
110  percent  of  the  final  steady  state  value.  All  the 
criteria  of  Fig.  6  were  originally  based  on  simulation 
data. 

The  transient  responses  for  the  exemplary  RSS  trans¬ 
port,  given  In  Fig.  3s,  falls  within  the  time  response 
boundaries  shown  in  Fig.  6,  although  It  nudges  the  upper 
boundary. 

While  we  hold  no  thesis  for  any  of  the  pitch  rate 
time  response  boundaries  of  Fig.  6,  they  do  encompass  the 
responses  for  the  example  RSS  aircraft  and  (except  for  an 
initial  delay  time)  are  generally  compatible  with  the 
Shuttle  itself,  which  la  also  an  RSS  aircraft.  By  adding 
the  NLR  proposed  rise  and  settling  time  limits  the  com¬ 
posite  Fig.  6  becomes  a  summary  of  time-domain  envelope 
criteria  specifically  proposed  for  aircraft  with  rats 
command/attf tude  hold  FCS.  The  boundaries  can  thus  at 
least  be  considered  exemplary,  and  can  be  used  ae  a 
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Figure  6.  Exemplary  Time  Domain  Response 
Boundaries  for  Pitch  Rate  Response 
of  RSS  Aircraft 
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convenient  framework  from  which  to  consider  possible  distinctions  between  conventional  and  superaugaented 
aircraft*  They  shall  be  used  as  stravtnen  below  to  serve  as  a  backdrop  for  data  comparisons. 

the  best  and  aost  current  set  of  flight  data  for  conventional  aircraft  precision  path  control  Is 
probably  the  landing  and  approach  higher  order  systea  (LAHOS)  study  of  Ref*  23.  These  experlaenta  used 
the  Calspan  variable  stability  NT-33  aircraft  in  an  approach  and  landing  task.  The  evaluation  flights 
were  continued  through  touchdown.  A  large  number  of  configurations  were  evaluated,  usually  by  two 
pilots,  with  repeat  evaluations  being  made  randomly  for  nany  of  the  configurations*  Six  of  these  config¬ 
urations  have  been  selected  as  being  particularly  relevant  to  the  points  at  Issue  here*  While  all  six 
meet  the  NLR  rise  time  criterion,  three  of  the  six  selected  LAHOS  configurations  exceeded  the  exemplary 
time  domain  RSS  aircraft  boundaries,  and  three  had  reaponsea  within  those  boundaries.  Both  sets  are 
shown  in  Fig.  7.  With  a  pilot  rating  of  3-1/2  as  a  boundary  between  dealrable  and  undesirable  workload, 
corresponding  approximately  to  the  MIL-Spec  Level  1  flying  quality  category.  Fig.  7a  Indicates  that  con¬ 
ventional  configurations  with  good  flying  qualities  may  not  meet  the  exemplary  RSS  boundaries.  On  the 
ether  hand,  the  three  configurations  which  have  responses  which  fall  within  the  exemplary  boundaries  have 
overall  pilot  ratings  between  6  and  7.  It  will  be  recalled  that  pilot  ratings  of  6.3  correspond  to  con¬ 
ditions  where  adequate  performance  cannot  be  attained  with  a  tolerable  pilot  workload.  These  configura¬ 
tions,  therefore,  demand  excessive  workload  and  pilot  compensation  for  control  purposes.  They  are  all 
poor  from  the  flying  qualities  standpoint,  and  border  on  the  unsafe  by  virtue  of  the  poor  control  and 
high  workload.  Incldently,  the  flight  path/attitude  lag  for  both  good  and  bad  configurations  is  1/Tq  ■ 
0.714  sec  .  Since  this  feature  la  the  same  for  all,  the  rating  differences  are  probably  associated  With 
the  attitude  component  of  precision  path  control. 

Thus,  the  LAHOS  data  indicate  that  conventional  aircraft  which  do  meet  the  exemplary  boundaries  can 
have  poor  flying  qualities  whereas  those  which  uo  not  can  have  good  flying  qualities.  Indeed,  the  marked 
similarity  between  some  of  those  responses  shown  in  Fig.  7b  and  the  response  of  the  example  RSS  superaug- 
mented  aircraft  in  Fig.  3a  could  be  used  to  support  a  contention  that  the  flying  qualities  of  the  example 
RSS  aircraft  would  be  poor.  [Logically,  however,  *11  that  can  be  said  to  this  point  is  that  the  exemp¬ 
lary  boundaries  are  not  suitable  to  define  good  flying  qualities  for  conventional  aircraft.] 

There  la,  of  course,  another  Interpretation.  This  is  quite  simply  that,  as  has  been  emphasized  all 
along,  superaugmented  aircraft  are  different  In  their  characteristics  and  are  not  necessarily  appropri¬ 
ately  Judged  by  data  from  conventional  configurations.  With  this  interpretation,  the  exemplary  bounda¬ 
ries  or  something  similar  could  conceivably  still  encompass  the  responses  of  heavily  or  superaugmented 
aircraft  which  have  good  flying  qualities.  Unfortunately,  there  are  very  few  data  available  which  apply 
to  heavily  augmented  aircraft  as  considered  herein  and  even  less  data  which  are  pertinent  _o  the  ideal¬ 
ized  superaugmented  condition.  A  very  recent  study,  however,  does  contain  one  data  point  which  does 
indeed  approach  the  superaugmented  situation.  This  appears  In  Ref.  24,  which  examined  the  handling  qual¬ 
ities  of  large  airplanes  in  the  approach  and  landing  phase  using  the  USAF-AFWAL /Calspan  Total  In-Flight 
Simulator.  The  study  simulated  a  453,600  kg  statically  unstable  airplane  as  the  RSS  baseline  vehicle. 
Several  control  systems  to  stabilize  the  aircraft  were  examined.  Among  these  was  one  which  corresponded 
to  the  augmentor  of  Fig.  1.  One  of  the  cases  studied  had  sufficiently  high  control  system  gain  to 
approach  the  superaugmentation  Idealization.  This  response  is  shown  in  Fig.  8.  The  overshoot,  while 
less  than  the  maximum  in  the  exemplary  boundary  is  extended  somewhat  further  and  the  rise  time  is  also 
fairly  large.  In  fact  the  response  Is  Just  outside  the  NLR  proposed  rise  and  settling  time  limits. 
Nonetheless,  this  pitch  rate  response  la  not  too  far  removed  from  the  exemplary  boundaries.  This  config¬ 
uration  was  evaluated  by  both  evaluation  pilots  used  in  the  study  and  received  generally  good  ratings. 
In  its  second  evaluation  by  one  pilot  It  was  given  a  Cooper-Harper  rating  of  1  which  Is  extremely  unusual 
(the  same  pilot  Initially  evaluated  it  as  4).  The  pilot  commentary  indicates  Initial  problems  in  trim, 
basically  in  attempting  to  "Keep  the  airspeed  and  attitude  organized."  After  familiarization,  however, 
the  same  pilot  noted  that  "Airspeed  control  is  excellent.  Once  I  get  it  trimmed  up  it  virtually  holds 
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Figure  7.  Comparison  of  Conventional  Configurations  with  Exemplary  Time  Domain  Boundaries  for  RSS 
Aircraft  [Conf lguratlona  are  identified  as,  e*g.  (3-C)  from  Ref.  23]. 


the  airspeed,  holds  attitude,  and  stays 
tr lasted  In  turns."  The  other  pilot  Indicated 
that  "airspeed  control  was  good,  predlct- 
able."  His  summary  comment  was  "Ho  major 
problems,  an  excellent  airplane."  From  these 
comments  It  would  appear  that  in  precision 
path  control,  a  superaugmented  configuration 
may  Indeed  exhibit  good  flying  qualities. 
There  does  appear  to  be  a  potential  familiar¬ 
ization  problem,  although  this  Is  rapidly 
overcome.  This  one  flight  data  point,  con¬ 
sidered  In  company  with  the  LAHOS  data  of 
Pig*  7,  goes  a  long  way  toward  justifying  a 
position  that  heavily  augmented  RSS  aircraft, 
especially  as  they  approach  the  auperaug- 
mented  condition,  cannot  satisfactorily  be 
Judged  by  criteria  or  compared  with  data  from 
conventional  aircraft. 

Can  one  currently  go  much  further  In  lay¬ 
ing  out  tentative  PCS  specifications  for 
Idealized  superaugmented  aircraft?  There  la 
another  solid  data  set  available  which  can  be 
culled  for  further  Insight.  Reference  22 
Includes  moving-base  ground  simulations  of  s 
large  number  of  rate-command,  attitude  hold 
systems  for  an  RSS  version  of  the  Fokker  F-28 
transport.  A  small  subset  (four  flight  con¬ 
ditions)  approached  superaugmented  status  In 
that  their  attitude  dynamics:  were  rate 
command/attltude  hold;  had  a  dominant  atti¬ 
tude  lead  time  constant  T  which  was  signifi¬ 
cantly  different  from  Tq . ,  were  nearly  Insen¬ 
sitive  to  Tq  ,  which  waeZ  nearly  cancelled  by 
a  neighboring  pole;  approximated  the  super- 
augmented  q/q88  response  form  of  Eq.  2.  Fig¬ 
ure  9  shows  the  four  "F"  conf lguratlona  for 
Ref.  22  which  are  close  to  superaugmented. 
Interestingly,  the  three-pilot  average 
Cooper-Harper  ratings  for  these  highly- 
augmented  RSS  configurations  put  the  exemp¬ 
lary  boundaries  in  a  much  more  favorable 
light  then  the  LAHOS  data  of  Fig.  7.  Pilot 
consents  for  configurations  F-3  and  F-4 
ranged  from  "Favorable  pitch  control  proper¬ 
ties  leading  to  reduced  pilot  workload" 
(F-3),  to  '*Very  good  pitch  control  and  sta¬ 
bilization  properties"  (F-4).  The  F-4  con¬ 
figuration  has  since  bean  flight  simulated  In 
the  USAP/Calapen  TIPS  (Ref.  25).  The  flight 
result  had  a  three-pilot  average  Cooper- 
Harper  rating  of  3.7  (1  pilot  "3",  2  pilots 
"4"],  In  contrast  with  Che  CHPR  of  2.3 
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Figure  R.  Flight  Simulated  Superaugmented  Airplane  Response 
for  Approach  and  Landing  (Ref.  24);  I/Tq^  •  0.53  sec*"1, 
1/Tq  -  1  sec”1 
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Figure  9.  Normalized  Tndlclal  q  Response  of  Ref.  22 
"F"  Configurations  Compared  to  Exemplary 
Criteria  (T*}  ■  1.4  sec) 
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(2  pilots  "2",  1  pilot  "3"]  for  the  moving  base  results.  Unfortunate* y,  the  F-4  conf lguratlon  la  very 
close  to  "conventional"  In  that  the  effective  attitude  lead  is  not  far  removed  from  Tq 


When  all  is  said  and  done,  it  now  appears  that  parts  of  the  exemplary  boundaries  of  Fig.  6  are  prob¬ 
ably  adequate  for  highly  augmented  aircraft  which  approach  the  superaugmented  Ideal.  The  NLR  rise  time 
and  the  present  shuttle  upper  bound  would  appear  to  offer  excellent  guidelines  for  precision  path  and 
attitude  control  In  approach  and  landing.  The  NLR  settling  time  requirement  Is  also  pertinent  although  It 
la  a  bit  leaa  stringent  than  the  upper  boundary.  For  a  lower  boundat/  the  1973  shuttle  envelope  might  be 
faired  Into  the  NLR  rise  time  criterion  to  provide  an  interim  envelope.  However,  It  should  be  plain  that 
more  data  are  needed  to  solidify  such  interim  time  domain  guidelines  Into  a  more  solid  and  reliable  FCS 
specification. 


ACC  EMULATION  Of  LAGS  Aft)  DELAYS  UTIODOCKD 
BY  m  COVT10L  SYSTM 


A  common  feature  of  all  heavily  augmented  aircraft  is  the  introduction  by  the  control  system  of  addl- 
tlonal  lags  which  may  tend  to  delay  the  actual  aircraft  response  buildup.  The  Idealized  responses  shown 
In  Fig.  3  start  with  an  instantaneous  pitching  acceleration  for  a  step  control  surface  Input.  In  actual¬ 
ity,  this  response  will  appear  more  as  shown  In  Fig.  10.  Because  of  the  lags,  after  a  step  Input  Is 
Instantaneously  applied  there  will  be  a  very  gradual  buildup  before  the  pitching  acceleration  begins  to 
ramp  off.  This  Initial  buildup  delay  Is  easily  measured  by  a  delay  time  tj.  Although  the  discussion  of 
this  delay  has  been  deferred  to  this  point.  It  Is  the  last  Item  listed  In  the  Table  1  comparison  of  pitch 
attitude  response  parameters  for  conventional  and  superaugmented  aircraft. 


In  all  the  responses  and  example  analyses  described  previously,  the  explicit  assumption  was  that 
actuation,  sensing,  filtering,  and  other  real  system  lags  were  ignored.  The  delay  time  accounts  for 
these.  In  the  conventional  aircraft,  t ^  will  be  due  primarily  to  the  surface  actuator  and  any  additional 
lags  chat  may  be  present  In  the  manual  control  system.  It,  characteristically.  Is  relatively  small. 
Typical  actuators,  for  sxample,  appear  like  first  order  systems  with  time  constants  on  the  order  of 
0.05  sec  or  so  for  small  amplitudes  of  movement.  Thus,  for  a  conventional  airplane  with  a  state  of  the 
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art,  fully  powered,  surface  actuating  aystea 
and  aanual  control  system,  the  effective  tlae 
delay  aay  typically  be  less  than  1/10  sec. 

With  heavily  augmented  or  auperaugaented 
aircraft,  additional  considerations  enter* 
As  It  turns  out,  all  tend  to  increase  the 
delay  tlae.  The  baseline  Is,  of  course,  the 
surface  actuator  shared  with  a  conventional 
counterpart.  The  relaxed  static  stability 
aircraft  which  relies  on  the  augmentation  to 
restore  favorable  stability  properties 
demands  a  controller-aircraft  system  minimum 
bandwidth  which  Is  characteristically  greater 
than  that  present  with  a  damping  only  aug- 
mentor*  Because  of  this,  the  augmentation 
system  bandwidth  for  rigid  body  control  comes 
closer  to  intruding  on  the  higher  frequency 
flexible  modes  of  the  aircraft.  So  that 
these  flexible  modes  do  not  become  important 
In  the  alrcraft/augmentor  system  stability, 
filters  are  often  used  In  the  control  system 
to  sttenuate  system  signals  which  may  arise 
due  to  the  lower  frequency  lightly-damped 
flexible  modes*  This  can  be  done  using 
either  low  pass  or  notch  filtering.  Over  the 
low  frequency  range  associated  with  pilot 
control,  either  type  of  filter  will  appear  aa 
an  effective  lag. 
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Figure  10.  General  Pitch  Rate  Response 
to  Step  Pilot  Input 


In  the  augmentation  system  filters  are  sometimes  required  for  certain  sensors,  such  as  normal 
accelerometers,  to  reduce  unwanted  inputs  from  the  local  vibratory  environment.  These  filters  also  add  to 
the  net  lag.  Further,  In  the  controller  Itself,  s  number  of  quite  small  time  constant  or  pure  time  delay 
elements  may  be  present*  For  Instance,  if  the  controller  Is  digital,  pure  time  delays  are  Introduced  due 
to  computing  operations,  and  filtering  may  be  Inserted  for  anti-aliasing  at  the  Input  and  smoothing  digi¬ 
tal  to  analog  conversions  at  the  output. 


Finally,  if  the  pilot  command  input  la  accomplished  via  a  aideatlck  or  low-force-input  control  column 
In  a  fly-by.-wlre  controller  Installation,  the  manipulator  will  transmit  both  the  desirable  coherent  pilot 
command  signals  and  undesirable  pilot-induced  noise*  The  latter  may  be  the  small  random  fluctuations  In 
pilot  control  precision  commonly  referred  to  ss  remnant,  or  may  be  more  excessive  In  vibratory  environ¬ 
ments.  In  either  event,  the  pilot-induced  noise  is  ordinarily  quite  wide  band,  whereas  the  appropriate 
control  signals  are  much  narrower  In  frequency  content*  The  manipulator  signal  accordingly  may  require 
filtering  before  it  is  presented  to  the  flight  controller. 


All  of  these  types  of  filtering  end  time  delays  are  called  out  In  the  exemplary  Fig*  1  augmentation 
system.  Their  associated  lags  are  Individually  quite  small.  However,  unless  great  care  Is  taken  in  the 
detailed  design  of  the  manipulator  and  other  controller  characteristics,  they  can  add  up  to  a  sizable 
quantity.  In  fact,  for  the  ALT  version  of  the  Space  Shuttle  Orblter,  auch  time  delaya  approached 
0.25  sec.  This  excessive  delay  pushed  the  ALT  version  of  the  Shuttle  pitch  rate  response  to  or  past  the 
lower  boundary  of  Its  own  specification  (Fig.  6).  As  demonstrated  in  Ref.  26  this  effective  delay  In  the 
ALT  orblter  played  an  Important  role  In  the  pilot  Induced  oscillation  encountered  In  Free  Flight  5  during 
the  approach  and  landing  sequence.  This,  and  similar  instances  In  advancad  fighters  which  are  also  RSS 
aircraft,  has  caused  a  great  deal  of  emphasis  to  be  placed  on  the  effects  of  auch  delays. 


Figure  11.  Comparison  of  MTL-*-B785C  Time  Delay  Requirements 
with  Data  from  Ref.  27 


While  the  flying  qualities  prob¬ 
lems  which  may  arias  from  excessive 
effective  delay  time  are  quite  well 
understood,  the  quantitative  picture 
le  still  clouded.  The  existing 
military  specification,  MIL-F-8765C 
(Rtf.  18)  puts  forth  requirements 
for  allowable  time  delays  as  e  func¬ 
tion  of  flying  quantise  levels* 
These  are  shown  in  Fig.  11.  The 
origins  of  tha  time  delay  require¬ 
ments  of  Raf.  30  are  not  well  docu¬ 
mented  and  these  bounds  were  set  up 
shortly  after  tha  basic  problems 
were  perceived  to  be  e  critical 
Issue • 

On  the  other  hsnd.  Ref.  27  shows 
the  boundaries  from  date  developed 
for  approaches  end  lending  using  the 
RASA  DFRF  F8  DFBW  airplane.  The 
high  stress  end  low  atreee  bounds 
depend  on  teak  precision*  For 
Level  1  the  MIL  SPEC  may  be  a  bit 
too  stringent  (Td  <0.1  esc),  since 
the  RASA  date  do  not  show  a  major 


shift  until  -  0.12  -  0.14  sec.  If  Cooper-Harper  ratings  of  6-1/2  are  taken  as  an  upper  Halt,  then 
the  high  stress  boundary  would  indicate  that  delay  times  somewhat  less  than  0.22  sec  (contrasted  with  the 
MIL  SPEC  0.20  sec)  might  be  permissible. 


It  must  be  recognized  that  delay  time  cannot  be  viewed  as  an  uncoupled  entity.  Instead,  It  is 
intrinsically  connected  with  other  flying  quality  metrics,  such  as  rise  time*  A  system  with  a  short  rise 
time  can  surely  accommodate  more  delay  than  s  system  with  a  longer  rise  time.  Both  time  delay  and  rise 
time  affect  the  attainable  bandwidth  of  piloted  control.  This  Is  recognized  as  one  of  the  alternate  spe¬ 
cification  factors  in  Ref.  19. 

It  is  especially  important  in  connection  with  delay  time,  aa  in  most  of  the  other  flying  quality 
issues  brought  up  in  this  paper,  that  precision  control  with  high  stress  or  high  urgency  conditions  be 
emphasized  In  design  and  testing.  Otherwise  the  Importance  of  some  of  these  issues  In  operational  flight 
precision  and  safety  will  be  missed.  A  very  large  time  delay  could  be  accommodated,  for  example,  if  the 
aircraft  is  lined  up  well  out  on  final  approach  and  no  urgent  correction  la  required  or  extreme  distur¬ 
bance  is  present. 

DIGITAL  SYSTEM  PECULIARITIES 

While  existing  full-time  multiple-redundant  fly-by-wire  flight  control  systems  have  both  analog  and 
digital  representatives  (e.g.,  the  F-I6  is  analog,  F-I8  and  Shuttle  are  digital),  the  majority  in  the 
future  will  almost  certainly  be  digital.  When  contrasted  with  the  behavior  of  continuous  analog  systems 
digital  FCS  exhibit  some  interesting  peculiarities.  These  Include  sampling,  aerial  processing  of  data, 
and  finite  word  length.  For  future  manned  systems  any  word  length  problems  are  likely  to  be  Insignifi¬ 
cant.  Serial  processing  results  In  order  of  call  effects  which  can  create  a  small  Incremental  time  delay 
that  sometimes  requires  careful  consideration  in  an  PCS.  The  sampling  features  are  the  moat  Important 
and  need  a  bit  more  discussion. 

Periodic  sampling  la  a  linear  operation,  yet  it  la  peculiar  in  that  a  sinusoidal  input  will  beget 
an  infinity  of  frequencies  in  the  output,  and  the  output  waveform  will,  on  the  average,  be  delayed. 
As  an  approximation,  the  transmission  of  a  sinusoid  through  a  sampling  and  hold  operation  described 
by  an  Impulse  sampler  with  sampling  rate  1/T  samples /second  and  a  hold  circuit  with  transfer  function 
(1  -  e"T8)/s,  will  be  given  by  the  describing  function 
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This  describing  function  implies  a  time  delay  of  1/2  the  sampling  interval,  and  an  amplitude  ratio  reduc¬ 
tion  when  input  frequencies  approach  twice  the  sampling  rate.  In  moat  cas»*s  the  delay  is  the  main  prob¬ 
lem  since  it  ia  a  component  of  the  total  delay  time  td. 

A  more  precise  and  satisfying  way  to  show  the  loop  transmission  and  stability  effects  of  sampling  la 
direct  digital  system  analysis  in  the  w-domaln  (Refs.  28  and  29).  Thia  uses  a  complex  variable  w  which 
la  derived  sa  a  bilateral  transformation  in  terms  of  the  z  transform  used  In  conventional  sampled  data 
analysis,  w  is  defined  as 


Recalling  that  *  •  eT*,  w  becomes 
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One  feature  of  the  w  domain  la  that  stability  boundaries  are  not  aaaoclated  with  the  unit  circle  aa  it  is 
in  the  z -dome In,  but  with  the  entire  left  bnlf  w  plane  similar  to  the  a-domaln.  Another  characteristic 
of  surpassing  importance  la  that  w  approach##  a  aa  the  sampling  Interval  T  approaches  zsro.  These  two 
features  permit  the  carryover  Into  the  dlgltel  world  of  many  continuous  system  design  procedures,  tech¬ 
niques,  and  insights. 

One  such  technique  la  the  use  of  w  transforms  to  provide  a  digital  system  equivalent  of  the  Laplece 
transform  for  continuous  systems.  Bode  diagrams,  root  locus  plots,  multlloop  analyses,  and  many  lules  of 
thumb  will  then  ell  work  well  using  w  ae  the  complex  variable  instead  of  s.  An  abbreviated  transform 


TABLE  2.  AM  ABBREVIATED  TRANSFORM  TABLE 
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table  is  given  In  Table  2.  A  key  point  to  notice  there  Is  that  the  v  transforms,  when  viewed  as  transfer 
function-like  entitles,  all  exhibit  a  right-half  plane  zero  at  w  -  2/T.  This,  of  course,  stems  from  the 
sample  and  hold.  When  loops  are  closed  around  w  transfer  functions  this  zero  has  the  expected  but 
unfortunate  property  of  drawing  the  loci  from  some  system  pole(s)  toward  or  into  the  unstable  region. 
The  effect  is  very  similar  to  that  caused  by  the  pure  time  delay  approximation  of  T/2  in  Eq.  7  (which 
itself  could  have  been  approximated  by  a  non-minimum  phase  lead  (1  -  sT/2). 

Another  interesting  feature  of  the  w  domain  is  a  shift  in  poles  and  zeros  as  one  goes  from  s  to  w. 
Consider,  for  instance  the  first-order  lag  a/(s  +  a). 
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where  a'  -  (2/T)(  1  -  e_aT ) /( 1  +  e-“T)  -  (2/T)  tanh  (aT/2).  Ualng 
the  value  of  a'  for  sampling  rates  which  are  high  relative  to 
aT/2  «  1,  becomes 


the  hyperbolic  tangent  series  expansion 
the  s-plane  pole  magnitude  a,  i*e.,  for 


a' 


((r)  • tAt )  - 


(12) 


Thua,  when  "a"  is  small  compared  witty  the  sampling  rate  the  s-plane  pole  at  s  »  -a  is  an  excellent 
approximation  to  the  w-plane  pole  at  w  -  -a'.  At  lower  rates  (or  larger  values  of  "a")  the  effect  of 
sampling  Is  to  reduce  the  magnitude  a'  of  the  w-plane  pole  relative  to  the  s-plane  pole  magnitude,  a. 

If  these  concepts  are  now  applied  to  FCS  analysis  considerations  the  first-order  effect  of  sampling 
is  to  Introduce  the  rhp  numerator  zero  at  -2/T,  while  the  second-order  effects  are  to  change  the  magni¬ 
tude  of  the  poles  and  zeros  in  the  w  transfer  functions  from  those  of  the  s-domaln  transfer  function. 
Ordinarily  the  FCS  sampling  rate  will  be  large  relative  to  the  FCS  frequencies  of  interest  (except,  per¬ 
haps,  for  flexible  modes)  so  the  addition  of  a  zerp  at  s  -  +2/T  in  the  regular  continuous  transfer  func¬ 
tions  will  often  provide  an  adequate  approximation  for  FCS  stability  and  dominant  mode  response  purposes. 
When  higher  frequency  modes  impinge  on  the  sampling  region  these  approximations  no  longer  apply  and  the 
more  exact  w-domain  poles  and  zeros  should  be  used. 

With  the  high  sample  rates  of  next  generation  digital  FCS  for  manned  aircraft  the  sampling  effects 
noted  above  are  not  as  likely  to  cause  trouble  on  the  actual  aircraft  as  they  are  earlier  In  the  simu¬ 
lation  phase  of  development.  There  are  particular  concerns  with  closed-loop  man-in-the-loop  simulation 
with  actual  hardware.  Remarkably,  analog  computers  have  almost  disappeared  from  many  research  and 
development  facilities  which  are  now  run  on  a  totally  digital  basis.  In  a  typical  simulation  the  air¬ 
craft  characteristics  may  be  programmed  onto  a  digital  computer  which  may  also  run  a  moving-base 
apparatus  and  parts  of  a  visual  display  attachment.  The  mathematical  models  of  the  vehicle  may  be  very 
complex  and  Include  many  nonlinear  characteristics,  lots  of  lookup  tables,  and  so  forth.  The  result 
ofren  is  a  full  computer  which  represents  a  continuous  airframe  by  a  fundamentally  digital  characteriza¬ 
tion  with  relatively  low  update  rates*  Now,  when  an  actual  digital  flight  controller  with  a  frame  rate 
of  80-100/a  is  used  In  conjunction  with  a  20/s  digital  simulation  of  a  continuous  airplane,  the  simulated 
stability  and  control  properties  of  the  aircraft  will  suffer  the  shifts  described  above.  Unrealistic 
delays  which  affect  the  pilot's  ratings  and  workload  assessment  will  appear.  Further,  if  these  "digital 
airplane"  affects  are  not  properly  accounted  for  even  the  basic  a ire ra ft /augment er  system  may  exhibit 
difficulties  which  are  really  only  imaginary.  There  have  been  times  when  the  actual  airplane  was  needed 
to  fully  appreciate  the  FCS  capabilities] 
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RESUME 

La  commande  multivariable  des  avions  a  manceuvrabilite  elevee,  dans  un  dotnaine  de  vol  etendu,  est  un 
su jet  qui  a  requ  une  attention  croissnnte  depuiJ  quelques  ann^es.  Du  point  de  vue  de  l'automaticierr,  ce 
sujet  est  tout  a  fait  voisin  du  probleme  de  1* asservissement  de  poursuite  dans  la  mesure  ou  un  vecteur  de 
variables  de  sorties  est  asservl  a  suivre  des  variables  de  consigne  evoluant  arbitrairement .  Ce  probleme 
est  encore  coaplique  par  le  fait  que,  dans  le  domains  de  manoeuvre  envisage,  le  modele  dynamique  est 
fortement  nonlineaire , variable  le  long  du  dooaine  de  vol,  et  sujet  a  de  severes  erreurs  ou  variations. 
Cependant,  les  objectifs  de  pilotage  doivent  etre  attaints  tout  en  respectant  les  specifications,  de 
qualltes  de  vol.  En  outre,  la  poursuite  doit  etre  assuree  malgre  1' action  continue  de  perturbations 
exterieures  et  la  turbulence  basse-frequence  doit  etre  compensee.  Des  defauts  importants  des  regulateurs 
issus  des  oethodes  classiques  sor.t  cites  et  une  theorie  aaelioree  du  regulateur  lineaire-quadratlque  a  deux 
niveaux  est  presentee.  Apliquee  au  pilotage  d'un  avion  d’arme,  ce  schema  de  regulation  permet  de  commander 
de  maniere  precise  des  manoeuvres  de  grande  amplitude  en  depit  d'  erreurs  ou  variations  de  modele,  tout  en 
isolant  les  specifications  concernant  les  qualltes  de  vol  de  celles  qui  caracterisent  le  rejet  des 
perturbations  exterieures.  La  maniere  dont  des  non-conformites  de  modele  ou  des  nonlinearites  sont  tolerees 
est  mise  en  evidence  par  des  simulations  numeriques. 


ABSTRACT 

The  multivariable  control  of  an  highly  maneuvering  aircraft  in  an  extended  flight  envelope  has  been 
receiving  a  growing  attention  in  recent  years.  From  the  control  designer  point  of  view,  it  bears  close 
relationship  to  the  servomechanism  problem  in  the  sense  that  a  vector  of  output  variables  is  regulated  to 
track  continuously  set  command  variables.  This  tracking  problem  is  further  complicated  by  the  fact  that,  in 
the  range  of  considered  maveuvers,  the  dynamic  model  is  highly  nonlinear,  variable  about  the  flight  domain 
and  prone  to  severe  modeling  errors  and  variations.  Yet,  piloting  objectives  must  be  met  while  satisfying 
handling  qualities  specifications.  In  addition,  tracking  must  be  maintained  under  continuously  acting 
external  disturbances  and  low-frequency  turbulence  must  be  rejected.  Important  defects  of  classical  methods 
are  shown  and  an  improved  theory  is  presented  and  applied  to  the  fighter  control  problem.  Tolerance  of 
model  mismatch  and  nonlinearities  i3  especially  demonstrated  in  numerical  simulations. 


INTRODUCTION 


En  reference  au  systeme  nonlineaire 

*  •  f(x,u)  ,  ieh”,  utK®, 

(1) 

I  -  g(x)  .  I!*P, 

Le  probleme  de  poursuite  optimale  est  la  realisation  d'une  loi  de  coanande  en  boucle  fermee  u(.)  telle  que 
la  sortie  z  suive  asymptotiquement  un  vecteur  de  consigne  donne  z<j,  soit 

lim  [  z(t)  -  z  .(c)]  -  0, 
t~»oo 

en  depit  de  perturbations  persistantes  et  de  variations  de  module. 


Un  defaut  commun  aux  lots  de  commande  actuellement  oonsiderees  est  qu'elles  requl&rent  la  connaissance 
precise  des  variables  d'equillbre  x*  et  u*,  solutions  de  x*  =  f(x#,uB)  2  0  et  g(xB)  2  zd,  correspondent  4 
la  solution  de  regime  permanent  de  (1),  pour  fonctionner  correctement.  Or,  la  solution  de  ces  Equations 
non lineal res  est  difficile  4  calculer.  Bien  plus,  ce  calcul  des  valeurs  d’equillbre  x#  et  u*  eat  coapllqu£ 
par  les  Inevitables  erreurs  et  variations  de  modele  et  par  l1 addition  de  perturbations  ext4rieures. 

Mfcme  en  utlllsant  des  lois  de  commande  de  Type-1,  c'est-4-dire  avec  action  integrals,  1' utilisation  de 
valeurs  d'equillbre  inexactes  a  pour  r^sultat  des  conflits  d' objectifs  pour  le  regulateur  de  poursuite  et 
de  graves  difauta  de  convergence  malgre  une  stabilite  apparemment  satlsfaisante.  II  est  done  approprle  de 
rechercher  des  lois  de  commande  qui  eiiminent  le  besoln  de  connattre  ces  valeurs  d'equillbre. 

En  outre,  lorsque  liquation  du  systfcme  nonlineaire  (1)  est  sujette  4  des  erreurs  de  mod&le  ou  4  des 
perturbations  lnconnues,  les  hearts  entre  les  variables  d'etat  et  de  commande  et  leurs  valeurs  d'equillbre 
respectives  ne  s'annulent  plus  individuellement  :  les  fonctlons  de  coQt  tradltionnellement  utlllsees  ne 
convergent  done  plus.  Ce  probleme  aathe*atique  amplifie  les  autres  difficultes,  surtout  si  l'on  souhaite 
exploiter  les  avantages  de  cette  fonetlon  de  coQt  quadratique,  par  example  pour  accroitre  la  robustesse  ou 
la  marge  multivariable  du  systime  control^  (voir  0,2]). 


Dana  cette  communication,  une  theorie  amelioree  du  regulateur  de  poursuite  est  presentee,  resoivant  tous 
lea  problemea  des  approches  classiquea.  L' expose  est  tout  particulierement  oriente  sur  la  maniere  de 
realtser  des  loia  de  coomande  de  pilotage  pour  un  avion  d'arme  moderne.  Une  structure  de  controleur  a  deux 
niveoux,  inspiree  des  idees  exprlmees  dans  [  3-5] ,  est  utilisee  pour  faciliter  le  respect  des  contraintes 
operaticnnellea  sur  les  variables  d'etat  et  de  coamande  ainsi  que  des  specifications  eoncernant  les 
quail tes  de  vol. 


II.  DESCRIPTION  DU  REGULATEUR  A  DEUX  NIVEAUX 


Le  premier  niveau  du  regulateur,  represente  en  Fig.  T ,  sous  forme  de  schema-bloc,  est  un  f litre  de 
conditionnement  des  consignes,  comprenant  un  modele  de  1’ avion  linearise  au  voisinage  du  vol  horizontal, 
caracterise  par  (xo*uq,zqsCx<)) »  soit 


6x 

■  A  6x  ♦  B  Su  , 

6x  cJR 

m 

m  m 

m 

6z 

-  C  6x  , 

8z  ew} 

(2) 


ou  S>xm=xm-xo,  Sun^v^-UQ,  Sz=za-zo- 


X.  * 


fig.  1  -  Configuration  gintrale  du  rtgulataur  d  daux  nivaaux. 


•  T  T 

Une  loi  de  commande  de  Type-1  est  appliquee  a  5 pour  stabiliser  le  systeme  augmente  (fix^  .e^  )  , 

ou  em  Azjq-z^,  c'est-a-dire  pour  assurer  la  convergence  de  zm  vers  Zj  avec  une  dynamique  lmposee.  Le 
regulateur  de  ralliement  de  modele  (2e  niveau),  qui  utilise  la  commande  611^  a  la  maniere  d'un 
"feedforward",  est  realise  de  maniere  a  assurer  la  convergence  des  variables  de  sorties  z  de  1* avion 
nonlineaire  pe^turbe  vers  celles  du  modele,  za. 


Aux  ecarts  entre  le  mouvement  non  lineaire  perturbe  (1)  de  l'avion  et  le  oouvement  lineaire  du  premier 
niveau  est  associe  un  modele  linearise 


6x  ■  f(x,u)  -  A  6x  -  B  6u 
m 

e  -  g(x)  -  g(x  )  »  C6x 


A  6x  +  B  6u  ♦  6, 


I  * 


♦  S , 


(3) 


2* 


bxeK*1,  Su  e®m.  et®  ,  ou  6x«x-x  «x-6x  -x,.,  6u«u-u  -u-Su  -urt  egalement  au  voisinage  du  vol  horizontal  et  kune 
*  *  *  m  m  0  mmO. 

valeur  particuliere  de  I'incidence  et  de  la  pression  dynamique  (/OlK).  La  quantite  61  est  un  vecteur 
rassemblant  les  perturbations  exterieures  ainsi  que  les  erreurs  de  modele  et  de  linearisation.  6 ?  contient 
les  residua  de  linearisation  de  g(x). 


Ce  modele  est  utilise  pour  elaborer  la  loi  de  coranande,  egalement  de  Type-1,  qui  sera  appliquee  a 
l'avion  nonlineaire  <1).  Cette  loi  lineaire  est  choisie  de  maniere  a  stabiliser  le  systeme  augmente 
[6x*r,eT]  T,  ou  e  ^  z-  fizffl-zo  c'est-a-dire  de  maniere  a  assurer  la  convergence  de  z  vers  et  dono 
de  z  vers  z<j,  avec  une  dynamique  imposee  et  en  depit  de  perturbations  constantes  &■}•  En  meoe  ^emps,  cette 
loi  tranquilise  le  systeme  controle  (puisque  6x  -*■  0)  a  une  valeur  de  regime  permanent  qui  o' est  pas 
connue  puisque  dependant  des  caracteristiques  reellfts  de  l'avion  ainsi  que  des  perturbations  exterieures. 
Enfin,  pour  toute  la  classe  des  perturbations  pour  lesquelles  le  mouvement  controle  de  (3)  sera  stable, 
la  loi  consideree  sera  egalement  stabiliaante  pour  le  systeme  nonlineaire  (1).  L’ architecture  generale  du 
regulateur  de  pilotage  est  representee  sur  la  Fig.  2. 


Limiteurs 


Perturb*  lions 


fig.  2  -  Archit&cturt  du  regulateur  da  pilotage. 


La  philosophic  de  la  regulation  a  2  niveaux  apparait  done  maintenant  : 

1/  Le  premier  niveau  permet  de  definir  la  reponse  (  6x  ,  Su  ,  6z  )  d'un  modele  idealise  de 

o  m  o 

l’avion,  lineaire  et  sans  saturations  de  gouvernes.  La  dynaaique  en  boucle  fermee  de  ce  systems  satisfait 
les  specifications  de  manceuvrabilite  et  de  qualJtes  de  vol.  Sa  rapidite  est  dictee  par  les  amplitudes  de 
gouvernes  souhaitees  pour  realiser  des  manmuvres  d'intensite  moyenne  ainsi  que  par  les  limitations 
concernant  les  facteurs  de  charge. 

2/  Le  deuxieme  niveau  realise  un  asservisseoent  raplde  du  mouvement  nonlineaire  de  1* avion  vers 
la  reponse  du  model®  (ler  niveau),  en  depit  d'erreurs  de  modele  (meconnalssance  des  coefficients 
aerodynaoiques,  variations  de  parametres,  couplages  gyroscopiques,  effets  de  la  pesanteur,  etc.)  et  des 
perturbations  atmospheriques.  On  verra  plus  loin  que  cet  asservisseoent  est  precis  en  ce  qui  concerne  les 
variables  de  manouvre  (z,z<j)  mais  "souple"  en  ce  qui  concerne  les  autres  variables  d'etat. 

En  1' absence  de  perturbations  ou  d'erreurs  de  modele  ou  de  linearisation,  done  au  premier  ordre, 
5u«6um  •  l’avion  recopie  done  l’evolution  du  modele.  En  raison  de  sa  dynamique  rapide,  le  second  niveau 
joue  egalement  un  role  d’ anti-turbulence.  Cependant,  puis  ue  ces  gains  rapides  ne  s'appliquent  qu'aux 
ecarts  entre  le  mouvement  de  1 'avion  reel  et  les  reponses  modele,  ils  n'ont  pas  pour  effet  d'entrainer 

la  mise  en  saturation  de  toutes  les  gouvernes  a  la  moln  sollicitatlon  du  manche  par  le  pilote.  Les 

actions  respectives  des  deux  niveaux  sont  illustrees  sur  le.  3. 


Fig.  3  -  Dist.nction  antra  regulation  da  " poursuita "  (lar  nivaaul  at  da 
"ralliament"  (24ma  nnraau). 


Ce  partage  des  "responsabiliteo"  entre  les  deux  niveaux  du  regulateur  de  pilotage  est  apparement  la 
seule  maniere  de  resoudre  le  compromis  impossible  entre  la  satisfaction  des  specifications  de  qualites  de 
vol  et  1' usage  de  gams  rapides,  necessaires  au  vol  a  haute  Incidence.  On  remarquera  que  1 'architecture 
decrite  est  compatible  non  seulement  avec  1' usage  de  lloiteurs  d' Incidence  ou  de  facteurs  de  charge  mais 
aussi  avec  le  choix,  pour  le  premier  niveau,  de  lols  de  commands  a  double  mode,  e'est-a-dire  munies  de 
gains  dependant  de  l'intensite  de  la  manmuvre  affichee  par  le  pilote. 

Choix  du  point  de  linearisation  :  Si  le  vol  horizontal  stabilise  a  ete  retenu  coame  point  de  linearisation 
pour  les  modeles  (2)  etT3)  ,  ce  choix  est  peu  critique  et  n'est  diote  que  par  des  raisons  de  comaodite.  On 
n'exige  er.  effet  de  ces  modeles  qu'un  realisme  minimum  rendant  compte  au  premier  ordre  mais  avec  coherence 
des  relations  de  cause  a  effet  existant  entre  les  differentes  variables  du  mouvement  de  1' avion  non 
controle  ainsi  que  des  evolutions  relatives  des  differentes  variables  a  1* occasion  d'une  manmuvre  donnee  de 
faible  amplitude.  On  verra  plus  loin  que  les  lois  de  commando  proposees  s'accommodent  en  realite  tres  blen 
d'ecarts  notables  avec  la  dynaaique  reelle  par  suite  d'erreurs  sur  certains  coefficients  ou  a  1' occasion  de 
manouvres  de  grande  amplitude. 


III.  FORMULATION  MATHEMATIQUE  ET  CALCUL  DES  LOIS  DE  COttiANDE 

Considerant  le  modeie  linearise  (2)  du  premier  niveau,  la  commands  stablllsatrlce 
convergence  de  ^  vers  z^,  est  choisie  de  maniere  a  minimiser  la  fonction  de  cout 


La  loi  de  commande  est  obtenue  dlrectement  de  la  forme 


*  ([fix  TQ®6x  ♦  (2  -*  )TQ®(z  -*,)  ♦  6u  TR®6*u  ]  dt. 
m  X1  m  m  d  2  m  d  m  mJ 

!  dlrectement  de  la  forme 

6u  •  K?  S%  *  f  (62  ♦  zn  -  z.)di  ♦  6m  1  . 
m  1  m  2  m  U  d  mn 


Les  gains  K®  et  K®  sont  tels  que 


ft  «$]  *  '  [0  ]  P  -  -  (R“>''B  ft.  P 1 2]  > 


P  P 
11  12 


assurant  la 


U) 


(5) 


P 
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eat  solution  de  1* equation  matricielle  de  dimension  (n+p) 


hvec 


PF  ♦  FTP  -  PG(Rm)~*GTP  ♦  Q  -  0, 


'a  0 

b 

[<£  0 

F  - 

,  c  - 

et  Q  - 

c  o 

0 

0 

est  une  quantite  peraettant 
gouvernes  en  fonction  de  l'etat  initial 


optionnelleaent^)  d' initialiser  optimalement 
6xn(0)  et  de  la  manouvre  commandee  z<j»  suivant 


b\  ■  ■<Blp|lB>"1  BM[PH(A*BK1)  *  P)2C]6V0)  •  P 1 2Zd  1 


de  maniere  a  hater  les  mouveoents  transitoires  (cf.  [6]). 


(6) 


les  braquages  des 


Dans  le  oas  consider^  ici  en  ce  qui  concerns  le  choix  du  vecteur  z,  la  palre  matricielle  (F,G)  etant 
stabilisable  et  la  paire  (H,F)  etant  observable,  ou  H"[°p  *pj  »  11  suffit  que  Ker  L  c  Ker  H,  avec 
L  £=  Qi  pour  qu*il  existe  une  solution  unique  1' equation  (6),  minimisant  Jn  et  faisant  tendre  asymptoti- 
quement  e'm^:  H  [6xmT  efflTj  *  vers  zero  et  dont  ^  vers  z<j.  Lorsque  ces  conditions  ne  sont  pas  verifiees,  en 

particulier  si  la  paire  (F,G)  n'est  pas  stabilisable,  des  tests  speciflques  portant  sur  L,  developpes  dans 
[6],  permettent  de  s’assurer  que  en,  tend  vers  zero. 


Considerant  maintenant  le  second  niveau,  c'est-a-dire  la  regulation  proprement  dite  de  1' avion,  la 
commande  6u  qui  stabilize  le  modele  linearise  (3)  est  choisie  de  maniere  a  minimiser  la  fonction  de  eout 
sulvante  oo 

*  J  JSxTQj&x  «■  e^Q^e  ♦  ♦  SuTrSu  j  dt,  ^ 

ou  k>  =  y  -  Ary,  y  =  Dx,  fix  =  x  -  xm  a  x  -  6  xm  -  x0,  Suru-Ug,,  e=z-zn=z-  6  zm  -  z0,  et  oil  Ar 
est  une  matrice  stable  arbitrairement  choisie  permettant  de  specifier  avec  une  facilite  accrue  un  modele 
(implicite)  de  convergence  des  reponses  du  systeme  perturbe  (1)  vers  les  trajectoires  a  grande  amplitude  du 
modele  de  poursuite  (2)  [7].  La  loi  de  commande  est  de  la  forme 


6u 


6u. 


♦  Kj6x  ♦  K2 


6 

m 


zo]dt> 


(8) 


ou  les  matrices  de  gains  Ky  et  K2  sont  programmees  et*  ou  la  quantite  6u^  peut  etre  prise  egale  a  zero  si 
les  integrateurs  de  (8)  sont  initialises  de  maniere  synchrone  avec  ceux  de  (5).  La  commande  reellement 
appliqu£e  A  1' avion  est  bien  sur  donnee  par 


us  6u  ♦  6um-uo» 

ou  uq  est  la  connande  -lecessaire  a  l'equilibrage  de  l'avion  au  point  de  linearisation  choisl. 
Les  gains  K^  et  de  (8)  sont  tels  que 

[*i  K2j  =  -R’*1  [3  ♦  CTPj  , 

ou  P  est  solution  de  l'equation  matricielle  de  dimension  (n+p) 

PF'  ♦  F,tP  -  PGR’-'QTp  ♦  Q  -  SpR'-’S  =  0, 
dans  laquslle  F’  =  F  -  GR*-'s,  R’  =  R  ♦  BTDTQ3DB,  S  »  [  B^D^CDA-ApD)  o], 

I"  Q  j  +  (nA-ArD)Tq3CDA-ArD)  0 

0  V 

et  oil  F  et  G  sont  telles  que  definies  plus  haut. 


(9) 


(10) 


Q  - 


Un  choix  arbitraire  des  variables  de  consigne  est  possible,  incluant  des  variables  d' angle,  de  vitesse, 
d' acceleration,  un  choix  mixte  sur  les  diff4rents  axes,  voire  des  fonctions  non-lineaires  de  ces  variables. 
La  formulation  proposee  pour  le  calcul  de  la  loi  de  commande  est  done  compatible  avec  toutes  les 
combinaisons  de  variables  aetuellement  etudi^es  pour  le  pilotage  par  objectifs  ("maneuver  control")  des 
avions  modernes.  Dans  le  cas  consid£r4  ici  en  ce  qui  ccnoerne  le  choix  de  z,  le  syst&me  (3)  etant 
stabilisable  et  observable  du  point  de  vue  du  triplet  matrlciel  (H,F,G),  il  sufflt  que  Ker  L  c  Ker  H,  avec 
L  =  q1,  pour  que  (10)  admette  une  solution  P  unique,  minimisant  Ja  et  raisant  tendre  asymptotiquement  6x 
et  e  vers  zero  (cf.  [6]). 

Du  point  de  vue  thlorlque,  1* introduction  de  p^nalltes  a  la  fols  sur  les  d£riv£es  des  variables  d'etat 
et  sur  les  deriv^es  des  coanandes  est  r£cente  [8,9].  Les  fonctions  de  coGt  quadratiques  (4)  et  (7) 
convergent,  m£me  en  cas  d'erreurs  ou  de  d4faut  de  conform! te  du  module.  Les  lois  de  commande  qui  en 
resultant  sont  telles  que  : 


♦Une  logique  d* initialisation  des  commandes  et  de  remise  4  tiro  des  integrateurs  lorsque  z<j  a  4t4  modifie 
de  maniere  significative  etant  encore  en  cours  de  aise  au  point,  la  valeur  =0  est  prise  dans  les 
simulations  presentees  en  Section  IV.  0 


1)  la  atabilite  "en  vitesse"  du  mouvement  de  l1  avion  perturbe,  c'est-a-dire  x— ►O  quand  t-*-oo  eat 
assure®,  et  que 

2)  la  convergence  aaymptotlque  (ralliement  sans  erreur)  de  z=g(x)  vers  zB=g(5xB-*-XQ)  et  done  de  z  =  g(x) 
vera  z^'t)  eat  realise®, 

ceci  dans  un  large  domaine  de  vol,  qui  n'est  pas  actuellement  entierement  quantifie  mais  qul  inclut  des 
manoeuvres  mettant  lea  gouvernes  frequemnent  en  saturation. 

On  pourra  bien  sur  discuter  de  la  necessite  de  disposer  de  lois  de  oommanae  precises  pour  le  pilotage 
d'un  avion.  S'il  est  certain  qu'une  telle  precision  n'est  pas  requise  dans  la  plupart  des  manouvres  rapides 
de  1' avion  (ex.  interception  ou  combat  tournoyant),  elle  est  cependant  desirable  pour  certainea  taches  (ex. 
pointage  d'armes,  vol  en  formation,  ravitaillement  en  vol,  atterrissage  ou  apontage)  qui  exigent  du  pilote 
une  attention  et  une  charge  de  travail  telles  qu’il  ioporte  de  lui  faciliter  la  conduite  du  vol  de  l'avion. 

La  mise  en  oeuvre  des  lois  de  commande  (5  et  (8-9)  ne  requiert  pas  la  connaissance  ds  valeurs  d'equilibre 
(l'equilibrage  statique  de  l'avion  est  automatique) .  Cet  aspect  est  secondaire  pour  le  choix  de  la  loi  (5) 
puisque,  par  definition,  le  systems  dynamique  du  premier  niveau  est  invariant  et  non  perturbA  ;  le  calcul 
des  valeurs  d'equilibre  serait  done  aise  (cf.  [lOJ ) .  II  est  cependant  d'une  importance  majeure  pour  la  loi 
de  commands  du  deuxieme  niveau.  L'equilibrage  automatique  est  particulierement  utile  pour  le  passage  en 
transsonique  dans  des  positions  variees  et  pour  compenser  les  perturbations  habituelles  du  vol.  Enfin,  en 
raison  de  la  tolerance  aux  erreurs  et  variations  de  module,  la  loi  (8)  permit  de  realiser  des  manouvres  de 
grande  amplitude. 

Parce  que  les  lois  de  commande  (5)  et  (8)  sont  obtenues  directement  et  sans  approximations  algebriques 
co name  dans  certaines  autres  methodes,  les  penalites  de  JB  et  sont  faciles  k  choisir  et  a  adapter.  Une 
demarche  particulierement  facile  consiste  en  effet  a  exploiter  les  relations  de  senslbllite  entre  les  poles 
du  systAme  controls  et  les  elements  des  matrices  de  penal ite  de  la  fonction  de  cout.  On  aaeliore  ainsi  un 
placement  de  poles  initial  en  agissant,  par  une  methode  de  gradient,  de  maniere  coordonnee  sur  tous  les 
elements  des  matrices  Q  et  R  de  Ja  et  de  Ja  (cf.  [11-12]),  ce  que  1' intuition  seule  ne  peut  parvenir  a 
realiser. 

Relations  de  transfert  :  Avec  les  notations  utilisees  plus  haut,  la  relation  d' entree-sortie  du  premier 
niveau  s' exprime,  denotant  les  transformees  de  Laplace  par  des  majuscules,  dAfinissant  Z< j=  JL  [5  z^sz^- 
z0j  ,  et  avec  6uqs0, 

6xn(»)  -  -  T,  (s)  [BK^Szd(5)  -  .Sx^O)], 

T  |  (a)  -  [a2!  -  s(A->BK^>  -  Bk“c]*’. 

De  meme,  omettant  S2>  le  deuxieme  niveau  satisfait  la  relation  de  transfert 

Sx(.)  -  5x(0) 

t2(»)  -[»2I  -  8 (A+BK j )  -  BK2c]''. 

Utilisant  le  fait  que  6x  =  x-  xn  =  x-  6  Xa  -  xq,  les  Aearts  A  x  =  x  -  xq  de  l'etat  de  l'avion  par 
rapport  au  point  de  linearisation  satisfont  liquation 

AX(s)  -  -TI(8)BK26ziC8)  ♦  sT^.^ICS,)  +  Ax(0)  -6xm(0)}  ♦  81,(8)  &xm(0). 

11  apparait  done  clairement  que  le  second  niveau  est  totalement  TRANSPARENT  vis  a  vis  des  consignes 
6  xm  (qui  agissent  bien  k  la  aanlAre  d'un  "feedforward”)  et  que  la  oonvergenoe  de  z(t)  vers  z^(t)  n'est 
condltionnAe  que  par  Tj(s),  c'est-A-dire  par  la  dynamique  du  premier  niveau.  La  dynamique  du  deuxlAme 
niveau  n'lntervient  que  dans  la  compensation  des  perturbations  extArieures  et  des  erreurs  d* initialisation 
de  la  manmuvre.  Elle  peut  done  Stre  arb itrai remen t  raplde,  etant  sans  Incidence  sur  les  qualltAs  de 
manmuvrabilitA  de  l'avion. 

11  apparait  en  outre  que,  du  fait  de  la  nature  proportlonnelle  et  intAgrale  des  lois  de  coonande  qui 
crAe  des  zAros  de  transmission  bloqueurs,  z(t)  converge  sans  erreur  vers  zd(t)  dans  la  assure  ou  les 
perturbations  tendent  vers  Z<j(s)  -  sCfBKzC)"1 <£  [6 i(t)J  .  On  rAduira  done  l’effet  des  erreurs  de  modAle  ou 
des  perturbations  en  accroissant  le  produit  BKj*  ou  ^  ®oins  sa  restriction  au  sous-espace  observable  par 
z. 


IV  -  SIMULATION  NUMERIQUE  DE  L'AVION  CONTROLE 

La  aAthodologie  prAsentAe  dans  les  sections  prAcAdentes  a  AtA  appllquAe  a  un  avion  de  combat 
relatlveaent  typlque  (Cbm  *-0.3)  muni  de  quatre  (m*4)  gouvernes  dont  une  gouverne  de  force  latArale 
directs,  avec  pour  choix  des  variables  d'objectlfs  (p=4) 

8  »  [».  P«,  q.  r] 

o&  v,  pa,  q  et  r  dAnotent  respect ivement  la  vltesse  de  dArapage,  le  taux  de  roulls  autour  du  vecteur 
vltesae,  la  Vitesse  de  tangage  et  la  vltesse  de  lacet.  En  fonction  des  variables  d'Atat,  pa  s' exprime  par 
la  relation  nonlinAaire  pa  *  (pu  ♦  qv  +  rw)  /  V, 

ou  p,  w  et  u  dAnotent  respect! vement  la  vltesse  de  roulls  en  axes  avion,  la  composante  normals  de  la 
vltesae  (incidence)  et  la  composante  longitudinals  de  oette  vltesse,  avec  Vs(u^v2«-w^)i.  Four  les  besolna 
de  la  commande,  le  modAle  dynamique  retenu  est  d'ordre  n*5  et  comprend  les  variables  xs  [v,w,p,q,rj.  Les 
variables  u,  $  (angle  de  roulls)  et  9  (assiette  longitudinals)  sont  intAgrAes  sAparAment. 
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Lea  simulations  qui  sont  presentees  ici  se  rapportent  a  un  cholx  de  matrices  de  penalites  des  fonctions 
de  cout  J-  et  Ja  qui  est  donne  dans  le  Tableau  1.  Ces  valeurs  n'ont  ici  qu'une  valeur  indicative  et  ne 
3auraient  etre  interpretees  coome  des  conclusions  ou  des  recommendations.  II  en  result®  pour  le  modele  de 
reference  (premier  niveau)  des  valeurs  propres  caracterisant  le  processus  de  poursuite  qui  sont  donnees  sur 
le  Tableau  2.  Outre  les  valeurs  propres,  le  Tableau  2  contient  aussi  la  matrice  de  projection  M 
transformant  la  matrice  aJ$  =  A  -  Rm*'GP  sous  la  forme  bloc-diagonale  de  Schur  ;  cette  matrice  indique  done 
comment  3e  projettent  les  variables  " canon lques"  du  mouvement  control®  dans  l'espace  physique  (variables 
canonlques  =x*=Mx).  On  observe  par  exemple  que  X.  =  ^  et  X7  se  rapportent  au  mouvement  longitudinal 
seul  et  que  le  mouvement  associe  a  X3  se  projette  principalement  sur  (r^r^)  tout  en  *yant  des 
composantes  non  nulles  sur  les  autres  variables  du  mouvement  lateral. 


Tableau  t  -  Matrices  de  p4nalit6  utilis&es. 


a, 


‘  t  OOOOE-04  O 
0  1. OOOOE -04 

o  0  0 

O  0 

O  0. 


0  0  0  1 

0  0  0  I 

1  OOOOE-03  0  0  I 

o  i  ooooe-03  o  i 

0  0  t  OOOOE-03 


OOOOE-04  0 


»  .  OOOOE -04  o 


1  0O00E-03  0 


OOOOE-03  0 


0000E-03  0 

1  OOOOE *01 


OOOOE  *02  0. 


1  OOOOE *04 


i  OOOOE *00  0 


1  OOOOE *00  0 


1  OOOOE *00  0. 


a)  Premier  niveau 


o»- 


R  . 


OOOOE -03  0 


OOOOE *0'  0 


OOOOE *00  O 
O 
0 


Ar. 


5  OOOOE *00  0 
0 
0 
0 


OOOOE *02  0 


OOOOE -0«  0 


a  9970E-01  0 
0  1  OOOOE 

0  0 


2  5B40E-02; 
►  00  0 

1  OOOOE *00 


3  OOOOE *00  0  0 

O.  -1  2000E  *00  0 

0  0  -1  5000E ♦ 


b)  Deuxiime  niveau 


OOOOE -04 


0  0  0 

1  OOOOE -04  0  0 

0  1  OOOOE -04  0 

0  0  1  000QF-04 


Tableau  2  -  Piles  du  processus  de  poursuite  I ler  niveau!. 
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Les  valeurs  propres  caracterisant  le  deuxifcme  niveau,  c'est-&-dlre  le  regime  perturbe  de  1* avion  par 
rapport  a  la  trajectoire  commandee,  sont  indiqu^es  dans  le  Tableau  3  cote-a-cote  avec  la  matrice  de 
projection  de  l’espace  modal  dans  l'espace  physique.  On  remarque  que  les  p6les  du  deuxieme  niveau  sont  plus 
rapides  que  ceux  du  premier  ;  ils  pourraient  d'ailleurs  l'etre  encore  davantage  en  fonction  des  reaultats 
de  la  simulation  de  1' avion  en  vol  perturbe,  actuellement  en  cours.  Tous  ces  p5les  sont  facilement  et 
separement  ajustables,  la  difficult^  du  probleme  r^sidant  uniquement  dans  le  choix  d'une  bonne 
configuration,  ce  qui  constitue  un  probleme  non  encore  r4solu. 


Tableau  3  -  Piles  du  processus  de  ralliement  (2e  niveau). 
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La  Fig.  #  montre  Involution  de  1* avion  contrSl*  k  1' occasion  d'une  mise  en  roulls  rapid®  (p..*  90*/s 
autour  du  vecteur  vltease),  a  230  m/s.  Les  diffirentes  courbes  montrent  les  Evolutions  respectlves  du 
premier  niveau  (trait  discontlnu)  et  du  deuxiime  niveau  (trait  continu).  Les  mouvements  period iques  des 


gouvernes  ont  pour  objet  la  compensation  cyclique  des  effets  de  la  pesanteur.  Sur  ces  courbes  comme  sur  les 
suivantes,  les  gains  sont  constants  (non- programmes  selon  a  >. 


-0.2  r  ,  ,  .  ._r _ T _ j  —  ,  -to.  *-  -  -  r  --  ,  ,  fiflUV.  Cjfcfi), 
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Fig.  4  -  Simulation  dt  I’svion  contrite  (commands  cte  roulit  constant). 


La  Fig.  5  montre  1' evolution  de  1’  avion  controls  dans  une  oanouvre  conjuguant  un  pique  constant  (q<j=- 
10°/S,  t  6  [0,7s]  )  et  une  perturbation  importante  de  roulis  rialisie  par  le  crineau  Pa,=-l80*/s,  t  €^.5*5s] 
et  pa  =-*-l80*/sf  t€(5,5.5s].  Dans  cette  situation*  les  vitesses  angulaires  de  I'avlon  sont  suffisantes  pour 
le  placer  dans  une  situation  instable  d' auto- tonneau.  Les  evolutions  des  differentes  courbes  rivelent  en 
effet  de  leg&res  perturbations  transitoires  du  mouvement  de  1’ avion  reel.  Le  fait  que  cette  manouvre  itait 
riellement  instable  pour  l'avion  non-controli  (en  rialiti,  un  point  de  bifurcation  est  depassi  [13])  est 
dimontre  sur  la  Fig.  6,  ou  les  commandos  du  mouvement  lateral  sont  annules  apris  6.5  secondes,  lea 

mouvements  de  grande  amplitude  de  v,p  ct  r  ne  disparaissant  que  lorsque  q  est  ramene  a  tiro. 

La  Fig.  7  montre  une  mise  en  virage  de  l’avion.  Les  derniires  simulations  prisentees  c<yicernent  enfln  le 
fonctionnement  en  mode  digrade,  ou  une  perturbation  de  roulis  ( s  1.5*10  )  et  de 

tangage  (  A  10“3)  est  appliques  a  I'avlon  en  mime  temps  que  le  Cq  est  annuls  (lea  gains  itant  ealcules 
par  rapport  a  la  situation  noainale  de  Caa  nor.  nul).  II  a’agit  d’abord  d'une  manmuvre  de  roulis  constant, 
representie  sur  la  Fig.  8,  et  que  I'on  comparers  avec  la  Fig.  A.  II  s'aglt  enfin  de  la  manoeuvre  de  piqui 
largement  perturbie  en  roulis  telle  que  dij4  eonsidirie  ;  elle  est  reprisentie  sur  la  Fig.  9  que  l’on 
comparers  avec  la  Fig.  5  (cas  non  perturb).  II  risulte  de  ces  comparaisons  que  I'avlon  controls 
a'accomaode  de  perturbations  exterleures  et  d'erreurs  laportantes  de  mod&le,  de  manlire  relatlvement 

transparente  pour  le  pilots  et  en  tous  cas  sans  erreur  pour  les  variables  de  riponse. 

Des  travaux  actuals  visent  k  aontrer  la  tolirance  de  ces  lois  vis-a-vis  de  servo-gouvernes  ou  de 
capteurs  k  bande  peasants  llmitee  ainsi  qu'a  sccroitre  cette  tolirance.  Avec  les  memes  gains,  la  lol  de 

cosande  considirie  dans  les  simulations  dija  dicrltes  tolire  ainsi  la  prisenoe  sur  chaque  canal  d’une 

aervo-gouverne  modellsie  comme  un  premier  ordre  ayant  une  frequence  de  coupure  de  A  Hz  (p8le  4  -25.13)*  En 
deqi,  sans  4tre  instable,  I'avlon  solliciti  pour  lss  memes  manoeuvres  que  cellea  qui  ont  M  dicrites  eat 
excessivement  perturbi  et  difficilement  pilotable.  Des  resultats  compliment a ires,  incluant  des  simulations 
en  presence  de  pertubations  ataosphiriques,  seront  prisentis  dans  une  proobaine  publication. 


fig.  S  -  Simulation  do  I'ovron  contrdU  (mi*  on  situotion  d’outo-tonnmu  on  piqoi). 
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Fig.  9  -  Simulation  de  I 'avion  contrite  (mite  an  situation  d'auto-  j 

tonneau  an  ptqui,  amc  arraur  da  modila). 


V  -  CONCLUSION 


One  philosophic  de  conmande  a  ete  proposee  pour  lea  regulateurs  de  pilotage  des  avlons  de  la  prochaine 
generation.  Elle  permet  de  satisfaire  k  la  fois  lea  specifications  concernant  les  qualites  de  vol  et  celles 
qui  concernent  le  re Jet  de  perturbations  exterieures.  Un  meme  regulateur,  even tuel lenient  au  noyen  de 
gouvernes  additionnelles  non-ciassiques,  peut  done  prendre  en  charge  le  pilotage  multivariable  et  1' anti¬ 
turbulence  sans  que  ces  fonctions  s'opposent  (leur  action  non  coordonnee  r4duit  en  effet  le  domaine  de 
vol).  Une  method© logie  a  4te  presentee  pour  fairs  la  synthase  complete  de  ces  lots  de  coonande.  Elies  ont 
ete  illustrees  par  des  simulations  dans  des  manmuvres  d' amplitude  ra isonnablement  elev4es  faisant  saturer 
plusieurs  gouvernes  et  ceci  en  presence  d'erreurs  de  modele.  Les  simulations  presentees  ici  se  rapportent  a 
un  avion  relativement  classique,  statiquement  stable  ;  appliquees  a  un  avion  tres  manoeuvrable,  les 
performances  observees  sont  evideament  bien  sup4rieures.  La  mise  en  oeuvre  de  ces  lois  requiert  pour  le 
premier  niveau  la  programmation  d'un  systeme  dynamique  d’ordre  5  muni  de  gains  programmes  ;  le  second 
niveau  se  raaenant  -quant  h  lul-  k  une  simple  "boite  a  gains",  eventuellement  programmes. 


On  remarquera  enfin  que  la  structure  de  ce  r4gulateur  de  pilotage  a  deux  niveaux  s' insere  parfaitement 
dans  une  chatne  plus  complexe,  par  example  pour  realiser  une  boucle  de  navigation.  Ainsi,  sur  la  Fig.  10, 
les  sorties  du  regulateur  de  navigation  peuvent  consister  en  un  vecteur  de  aanouvres  deslr4es  z<j,  aglssant 
comme  affichage  pour  le  regulateur  de  pilotage.  Le  selecteur  de  mode  represent^  peut  avoir  pour  entrees  : 


1)  1* affichage  par  le  manche  ou  le  palonnier,  pour  le  pilotage  "toutes  manoeuvres", 

2)  les  sorties  d*un  auto-pilote  de  navigation, 

3)  les  sorties  d’autres  regulators  sf^clallsis  tels  que  les  rsgulateurs  de  tlr. 
t€gle  ayant  ete  deja  decrite  dans 


cette  derniire  stra- 


i 


[ 


i 


Fig.  10  -  Coordination  dm  booctea  da  pifotaga  at  da  navigation 


REFERENCES 


1.  Mereier,  O.L.  et  Bourles,  H.,  Developpement  de  lois  de  pilotage  multivariables  robustes  pour  les 

avions  futurs.  Rapport  Technique  ONERA  n®  4/722*1  SY,  D4cembre  1981. 

2.  Bourles,  H.,  et  Mereier,  O.L.,  Marges  de  stabilite  et  robustesse  structurelle  general isees  des 

regulateurs  lineaires-quadratiques  multivariables,  Revue  RAIRO  Automatlque,  Vol.  16,  1,  Janvier  1982, 
49-70. 

3.  Tiroshi,  I.,  et  Elliott,  J.R.,  Explicit  Model  Following  Control  Scheme  Incorporating  Integral 

Feedback.  J.  Aircraft,  Vol.  11,  6,  Juin  1974,  364-366. 

4.  Tyler,  J.S.,  Jr.  The  Characteristics  or  Model- following  Systems  as  Synthesized  by  Optimal  Control. 

IEEE  Trans..  Vol.  AC-9,  5,  Octobre  1964,  485-498. 

5.  Trankle,  T.L.  et  Bryson,  A.E.,  Jr.  Control  Logic  to  Track  Outputs  of  a  Command  Generator,  J.  Guidance 
and  Control,  Vol.  1,  2  Mars-Avril  1978,  130-135. 

6.  Bourles,  H.,  et  Mereier,  O.L.-,  La  regulation  de  poursuite  optimale  quadratique  multivariable  des 
systimes  lineaires  perturbes,  Revue  RAIRO  Automatlque,  Vol.  16,  4,  Octobre  1982. 

7.  Kreindler,  E.,  et  Rothschild,  D.,  Model-Following  in  Linear-Quadratic  Optimization.  AIAA  Journal,  Vol. 
14,  Julllet  1976,  835-842. 

8.  Sandell,  N.R.,  et  Athans,  M.,  On  type-L  multivariable  linear  systems.  Autoaatica,  Vol.  9,  1,  Janvier 
1973,  131-136. 

9.  Gustafsson,  S.E.,  A  theory  for  optimal  P.I.  control  of  multivariable  linear  systems.  Acta  Polytechnics 
Scandlnavica,  Math,  and  Comp.  Sci.  Series,  Helsinki,  17,  1975. 

10.  Kirszenblat,  A.,  Calcul  d'un  systeme  de  commande  a  deux  niveaux  du  mouvement  nonlineaire  d'un  avion. 
Note  Technique  ONERA  n®  1979-7,  Septembre  1979  ;  ESA  Tech.  Transl.  TT-614. 

11.  Mereier,  O.L.,  Gradients  et  sensibilites  asocles  aux  problemes  de  commande  lineaires-quadratiques- 

gausslens.  Rapport  Technique  n®  1/3534  SN,  1982. 

12.  Mereier,  O.L.,  Joannic,  Y.,  et  Moreigne,  0.,  Mise  au  point  interactive  des  regulateurs  lineaires- 

quadratiques  par  action  directs  et  selective  sur  les  poles  du  syst&me  control^.  Accepte  pour 
publication,  Symp.  d'lnformatique  Appliqu6e  de  1*IASTED,  15-17  Mars  1983,  Lille  (France). 

13.  Guicheteau,  P.,  Application  de  la  th^orie  des  bifurcations  a  1' etude  des  pertes  de  controle  sur  avion 

de  combat.  Proc.  AGARD-FMP  Symp.  "Combat  Aircraft  Manoeuvrability",  Florence,  5-8  Octobre  1981,  La 

Recherche  Aerospatiale,  n®  2,  Mars-Avril  1902,  61-73* 

14.  Dang  Vu,  B.,  Multivariable  aircraft  control  by  manoeuvre  coanands.  An  application  to  air-to-ground 
gunnery.  Proc.  12e  Congr£s  ICAS,  Munich,  RFA,  12-1 7  Octobre  1980. 

15.  Dang  Vu  ,  B.,  Pilotage  d'un  avion  par  objectifa.  Application  au  tir  canon  air-sol.  La  Recherche 
Aerospatiale,  n®  3,  Mai-Juin  1981,  149-159. 


- - - — 


3-1 


MICROPROCESSOR  IMPLEMENTATION  OF 
FAST-SAMPLING  DIRECT  DIGITAL  FLIGHT-MODE  CONTROLLERS 

Prof  B  Porter,  Dr  A  Bradshaw,  Dr  A  Garis,  and  Dr  M  A  Woodhead 
Department  of  Aeronautical  and  Mechanical  Engineering 

University  of  Salford  { 

Salford  M5  4WT  | 

England  I 

I 


SUMMARY 

The  general  results  of  Bradshaw  and  Porter  {1),[2]  are  extended  to  allow  for  a  com¬ 
putational  time-delay  of  up  to  one  sampling  period  by  a  simple  modification  of  the  con¬ 
trol  algorithms.  The  resulting  control  algorithms  are  simple  to  implement  and  provide 
tight  non-interacting  control.  Their  efficiency  and  effectiveness  are  demonstrated  by 
the  presentation  of  the  results  of  a  laboratory  microprocessor  implementation  in  which 
the  controllers  are  required  to  effect  fuselage  pitch  pointing  and  vertical  translation 
manoeuvres  in  the  case  of  an  analogue  computer  representation  of  the  YF-16  aircraft. 


1.  INTRODUCTION 

The  general  results  of  Bradshaw  and  Porter  [1],(2]  for  discrete-time  tracking 
systems  indicate  that  tight  non-interacting  control  is,  in  general,  achievable  by  the  im¬ 
plementation  of  fast-sampling  error-actuated  controllers.  Indeed,  the  efficiency  and 
effectiveness  of  such  controllers  has  been  demonstrated  by  their  application  to  the 
YF-16  aircraft  where  they  are  required  to  effect  fuselage  pitch  pointing  and  vertical 
translation  manoeuvres  (3).  Implicit  in  these  controllers,  however,  was  the  assumption 
that  the  computational  time  delay  is  small  compared  with  the  sampling  period.  In  some 
cases,  this  assumption  may  not  be  valid  and  it  is  necessary  to  compensate  for  the  time 
delay.  Indeed,  if  no  such  compensation  is  provided  the  resulting  tracking  system  will 
have  either  very  poor  performance  or  will  be  unstable. 

The  general  results  of  Bradshaw  and  Porter  HI, [21  can  be  extended  to  allow  for  a 
computational  time  delay  of  one  sampling  period  if  the  control  algorithm  is  appropriately 
modified.  The  resulting  control  algorithms  are  simple  to  implement  and  provide  tight 
non-interacting  control.  Their  efficiency  and  effectiveness  are  demonstrated  by  the 
presentation  of  the  results  of  a  laboratory  microprocessor  implementation  in  which  the 
controllers  are  required  to  effect  fuselage  pitch  pointing  and  vertical  translation 
manoeuvres  in  the  case  of  an  analogue  computer  representation  of  the  YF-16  aircraft. 


2.  DISCRETE-TIME  TRACKING  SYSTEMS  WITH  FINITE  TIME-DELAY  COMPENSATION 
2 . 1  System  Configuration 

In  general,  high-performance  discrete-time  tracking  systems  with  finite  time-delay 
compensation  consist  of  linear  multivariable  plants  governed  on  the  continuous-time  set 
T  =  [0 , +«)  by  state,  output,  and  measurement  equations  of  the  respective  forms 


Xj  (t)' 
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x2  (t) 

11 
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x.  (t) 


y (t)  =  [c2  ,  c2\ 


u  { t ) 


(1) 


(2) 


w(t) 


[Fi  ,  F2] 


(3) 


together  with  fast-sampling  error-actuated  digital  controllers  governed  on  the  discrete¬ 
time  set  Tt  “  { 0, T , 2T, . . . }  by  control-law  equations  of  the  form 


s(kT) 

and  computational  time-delay  compensation  equations  of  the  form 
r (kT)  =  s(kT)  -  yr{ (k-l)T) 


(4) 


(5) 


! 

t 
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where 


e  (kT)  =  v (kT)  -  w (kT) 


(6) 


and 


z  (kT) 


(7) 


j=k-l 

=  z(o)  +T  I  e ( jT) 
j=0 

In  equations  (I)  to  (7),  xi(t)  e  Rn~p,  x2(t)  e  R*  u(t)  e  Re,  y(t)  e  R*,  w(t)  r  R* , 

Au  e  r  (n-£.)x  (n-i)  f  A,,  t  fc(n-£)xf,  A2i  e  Rlx(n-lJ#  A  e  r?x«,  b2  e  R£xf,  Ci  c  R^x{n-*>, 

C  2  £  F1  e  R*x(nxl)#  p2  e  Rix£,  rank  C2B2  <  i ,  rank  F2B2  -  * ,  r(kT)  t  R-,  s(kT)  e  R', 

v  (kT)  e  R5-,  e(kT)  e  R*,  z(kT)  e  R£ ,  K0  £  R£xt,  Ki  e  R£x?. ,  f  a  i/t  is  the  sampling 
frequency,  and  \  e  R  is  the  delay  compensation  parameter.  Since  the  computational  time 
delay  is  one  sampling  period,  the  digital  controller  is  required  to  generate  the  control 
input  vector 

u ( t )  =  r{ (k-1 )T}  ,  t  e  IkT, (k+l ) T)  ,  kT  t  Tt  ,  (8) 

so  as  to  cause  the  output  vector  y(t)  to  track  any  constant  command  input  vector  v(t)  on 
T-j.  in  the  sense  that 

lim{vOcT)-y (kT) )  *  O  (9) 

k-*°° 


as  a  consequence  of  the  fact  that  the  error  vector  e(t)  *  v(t)  -  w(t)  assumes  the 
steady-state  value 

lim  e(kT)  =  lim{ v (kT) -w (kT) )  =  O  (10) 

k-*-®  k-+°° 

for  arbitrary  initial,  conditions.  In  case 

tf1  ,  F2]  «  (Cj+MAn  ,  C2+MA12]  ,  (ID 

it  is  evident  from  equations  (2),  (3),  and  (11)  that  the  vector 


w(t)  -  y  ( t) 
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ma121 


’xt  (t) 
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(12) 


of  extra  measurements  is  such  that  v(kT)  and  y(kT)  satisfy  the  tracking  condition  (9) 
for  any  M  e  Rlx(n-l)  if  e(kT)  satisfies  the  steady-state  condition  (10),  since  equation 
(1)  clearly  implies  that 


limlA 
t-*«  L 1 


A1  21 


xt  (t) 
x2  (t) 


=  0 


(13) 


in  any  ste..  state.  However,  the  condition  that  rank  FjB2  =  l  requires  that  C2  and  A12 
are  such  that  M  can  be  chosen  so  that 


rank  F2  =  rank  (C2+MA12)  =■  l 


(14) 


If  the  control  input  vectors  are  stored  in  the  manner  of  Koepcke  (41  by  introducing  the 
extra  state  variables 


q{ (k+l ) T }  =  Tu (kT) 


(15) 


then  it  is  evident  from  equations  (1)  to  (7)  and  (15)  that  such  discrete-time  tracking 
systems  are  governed  on  rT  by  state  and  output  ei  lations  of  the  respective  forms 
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It  is  evident  from  these  results  that  the  computational  time-delay  has  no  affect  on  the 
'slow'  modes  as  f  -  ®  but  that  the  'fast*  modes  are  crucially  affected  as  f  •*  In¬ 
deed,  in  case  no  time-delay  compensation  is  used  so  that  y  =  0,  it  is  evident  from 
equation  (32)  that  at  least  some  of  the  ’fast*  modes  will  be  unstable. 


2 . 3  System  Synthesis 

It  is  evident  from  equations  (11),  (13),  (16),  and  (17)  that  tracking  will  occur  in 
the  sense  of  equation  (9)  provided  only  that 

Z  U  .  ,  <=  p-  (35) 

s  f 

where  -.s  the  open  unit  disc.  In  view  of  equations  (30),  (31),  and  (32),  the  'slow’ 
and  'fast'  modes  will  satisfy  the  tracking  requirement  (35)  for  sufficiently  small 
sampling  periods  i/  the  time-delay  compensation  parameter  y  and  the  controller  matrices 
K0,  Ki,  and  M  are  chosen  such  that  Zj  <=  p-,  Z2  c=  P",  and  Z3  *=  P“.  Indeed,  if  full  time- 
delay  compensation  is  employed,  y  =  1  and  stability  of  the  'fast'  modes  is  assured  by 
requiring  that 

F2B2Ko  =  diag (Oj ,o2 , . . . ,c£)  (36) 

where  1-Oj^e  R  ft  P~  ( j=l  ,2 , . . . ,  Jl)  .  Moreover,  if  in  addition  M  is  chosen  such  that  both 
MX)  and  Jr(X)  are  diagonal  transfer  function  matrices,  then  it  is  evident  that  in¬ 
creasingly  non-interacting  tracking  will  occur  as  f  ®. 


3.  DIRECT  DIGITAL  FLIGHT-MODE  CONTROL  SYSTEMS  WITH  FINITE  TIME -DELAY  COMPENSATION 
3.1  Vertical  Translation  Manoeuvre 


In  the  vertical  translation  manoeuvre,  the  linearised  longitudinal  dynamics  of  the 
YF-16  aircraft  flying  at  a  Mach  number  of  0.8  at  sea  level  are  governed  on  T  by  state 
and  output  equations  of  the  respective  forms  13] 


x,  it)' 

0 
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0 

rx.it)] 

0  ,  0 

.l 

Uj  (t) 

x2(t) 
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x2  (t) 
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-35.44  ,  -5.124 
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0.985 

-2.155. 
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- 
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^2(t)j 
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r  0  ,  1. 

xx  (t) 
X2  (t) 
-x3 


(38) 


where  Xi<t)  is  the  change  in  pitch  angle,  x2(t)  is  the  rate  of  change  of  pitch  angle, 
X3(t)  is  the  change  in  angle  of  attack,  ui(t)  is  the  elevator  deflection,  and  U2(t>  is 
the  flaperon  deflection.  Hence,  in  case  101,02)  -  (1,1),  y  =  1,  Kj  =  K0,  and 


M 


0.25 

0 


(39) 


it  follows  from  equations  (3) ,  (8) ,  and  (36)  that  the  corresponding  transducers  and 
fast-sampling  error-actuated  digital  controllers  with  finite  time-delay  compensation 
are  governed  on  T  and  TT  by  the  respective  measurement  and  control-law  equations 


and 
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(40) 


(41) 


It  is  evident  from  equations  (30),  (31),  and  (32)  that  Z\  =  fl-T,l-T),  Z2  *  { 1-4T),  and 
Z3  *  {0,0}.  It  is  also  evident  from  equations  (23),  (33),  and  (34)  that  the  asymptotic 
transfer  function  matrix  assumes  the  diagonal  form 
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4T 

X-1+4T  ' 


and  therefore  that  the  direct  digital  flight-mode  control  system  for  the  vertical  trans¬ 
lation  manoeuvre  of  the  aircraft,  with  a  time  delay  of  one  sampling  period  in  the  im¬ 
plementation  of  the  control  action,  will  exhibit  increasingly  non-interacting  tracking 
behaviour  as  f  ■*  »  when  the  piecewise-constant  control  input  vector  [uj(t)  ,  U2(t)]T  = 
(ujfkT)  ,  U2(kT)]T,  t  e  (kT,(k+l)T),  kT  e  T-p,  is  generated  by  the  fast-sampling  digital 
controller  governed  on  Ij  by  equation  (41). 


3 . 2  Fuselage  Pitch  Pointing  Manoeuvre 

In  the  fuselage  pitch  pointing  manoeuvre,  the  linearised  longitudinal  dynamics  of 
the  YF-16  aircraft  flying  at  a  Mach  number  of  0.8  at  sea  level  are  governed  on  T-  by 
state  and  output  equations  of  the  respective  forms  [3] 

x.  ft)l  [0  ,  1  ,  0  1  fx,  (t)l  To  ,  0  1 

fu.it) 

x ^ ( t )  =  0  ,  -2.068  ,  10.029  x.(t)  +  -35.44  ,  -5.124  (43) 

X,(t)J  [o  •  0.985  ,  -2.155J  |_x,(t)J  [  -0.238  ,  -0.308j  * 


o  ,  0 
o  ,  -1 


where  Xj (t)  is  the  change  in  pitch  angle,  x2(t)  is  the  rate  of  change  of  pitch  angle, 
X3(t)  is  the  change  in  angle  of  attack,  ui  (t)  is  the  elevator  deflection,  and  u2(t)  is 
the  flaperon  deflection.  Hence,  in  case  103,03)  =  {1,1},  K ,  =  K0,  and 


it  follows  from  equations  (3) ,  (8) ,  and  (36)  that  the  corresponding  transducers  and 
fast-sampling  error-actuated  digital  controllers  with  finite  time-delay  compensation 
are  governed  on  T  and  1T  by  the  respective  measurement  and  control-law  equations 


u  (kT)  -0.127  ,  0.528  e. (kT)  -0.127  ,  0.528  z, (kT) 

1  -  f'  1  + 

_u2(kT)J  |_  0.098  ,  -3.655J  l_e2(kT)J  [  0.098  ,  -3 . 655_|  [z2  (kT)  J 

u,  {  (k-l)T)" 

1  .  (47) 

u2{  (k-l)T). 

It  is  evident  from  equations  (30),  (31),  and  (32)  that  Zj  =  (l-T,l-T),  Z2  «  {1-4T),  and 
Z3  =  (0,0).  It  is  also  evident  from  equations  (23),  (33),  and  (34)  that  the  asymptotic 
transfer  function  matrix  assumes  the  diagonal  form 


and  therefore  that  the  direct  digital  flight-mode  control  system  for  the  fuselage  pitch 
pointing  manoeuvre  of  the  aircraft,  with  a  time  delay  of  one  sampling  period  in  the  im¬ 
plementation  of  the  control  action,  will  exhibit  Increasingly  non-interacting  tracking 
behaviour  as  f  ■*  «  when  the  piecewise-constant  control  input  vector  lui(t)  ,  U2(t))T  * 
(uj  (kT)  ,  u 2 ( kT ) ] T ,  t  t  (kT , (k+1 ) T) ,  kT  e  TT,  is  generated  by  the  fast-sampling  digital 
controller  governed  on  TT  by  equation  (47) . 


4.  LABORATORY  MICROPROCESSOR  IMPLEMENTATION  STUDIES 


4 . 1  Apparatus 

The  laboratory  apparatus  {6]  for  the  study  of  the  microprocessor  Implementation  of 
such  controllers  consists  of  an  EAI180  analogue  computer  for  the  simulation  of  a 
linearised  model  of  the  plant  (equations  (37)  and  (38)  or  (43)  and  (44)),  a  micro¬ 
processor  system  based  on  the  M6800  MPU  for  the  computation  of  the  controller  equations, 
and  a  data-acquisi tion  system  for  data  handling  and  processing  between  the  controller 
and  the  plant. 

The  microprocessor  system  is  focussed  upon  the  M68SAC1  Stand  Alone  Computer  module. 
This  module  provides  the  user  with  a  means  of  efficiently  interfacing  the  MPU  to  peri¬ 
pheral  devices  through  an  Mc6850  ACIA  or  an  Mc6820  PIA  depending  upon  the  data-format 
required.  In  addition,  this  module  is  interfaced  with  an  external  memory  module, 
MM568103,  of  2K  RAM  and  an  arithmetic  processor  unit  module,  M66MM14,  to  improve  the 
efficiency  of  the  arithmetic  manipulations. 

The  data-acquisition  system  consists  of  a  high-level  A/D  module,  M68MM15A,  and  an 
analogue  output  D/A  module,  MP7104.  Both  these  modules  include  multiplexers,  amplifiers, 
filters,  and  sample  and  hold  circuits. 


4 . 2  Vertical  Translation  Manoeuvre 


The  simulated  behaviour  of  the  YF-16  aircraft  in  the  vertical  translation  mode  when 
controlled  in  accordanced  with  equation  (41)  is  shown  in  Fig  1  when  the  command  input 
vector  is  'ramped  up’  in  2  sec  to  the  steady  value  [v^ (t)  ,  V2(t)]T  =  [0  ,  2]T  deg.  In 
these  tests,  a  sampling  period  of  0.0$  sec  is  used  and  it  is  evident  that  high-accuracy 
non-interacting  tracking  behaviour  is  achieved  despite  the  time  delay  of  one  sampling 
period  in  the  control  action.  Furthermore,  it  is  apparent  from  Fig  1  that  the  vertical 
translation  manoeuvre  is  effected  without  the  use  of  excessive  transient  control  surface 
deflections . 

4 . 3  Fuselage  Pitch  Pointing  Manoeuvre 

The  simulated  behaviour  of  the  YF-16  aircraft  in  the  fuselage  pitch  pointing  mode 
when  controlled  in  accordance  with  equation  (47)  is  shown  in  Fig  2  when  the  command  in¬ 
put  vector  is  'ramped  up’  in  1  sec  to  the  steady  value  tv* (t)  ,  V2(t)jT  =  (2  ,  0]T  deg. 
In  these  tests,  a  sampling  period  of  0.05* sec  is  used  and  it  is  evident  that  high- 
accuracy  non-interacting  tracking  behaviour  is  achieved  despite  the  time  delay  of  one 
sampling  period  in  the  control  action.  Furthermore,  it  is  apparent  from  Fig  2  that  the 
fuselage  pitch  pointing  manoeuvre  is  effected  without  the  use  of  excessive  transient 
control  surface  deflections. 


5 .  CONCLUSION 

The  general  results  of  Bradshaw  and  Porter  U1,12]  have  been  extended  to  allow  for 
a  computational  time  delay  of  up  to  one  sampling  period  by  a  simple  modification  of  the 
control  algorithms.  The  resulting  control  algorithms  are  simple  to  implement  and  pro¬ 
vide  tight  non-interacting  control.  Their  efficiency  and  effectiveness  have  been  demon¬ 
strated  by  the  presentation  of  the  results  of  a  laboratory  microprocessor  implementation 
in  which  the  controllers  were  required  to  effect  fuselage  pitch  pointing  and  vertical 
translation  manoeuvres  in  the  case  of  an  analogue  computer  representation  of  the  YF-16 
aircraft . 
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Vertical  Translation  Mode  ,  t  -  1/20  secs 
Time-delay  of  1/20  secs  In  the  control  action 
Flight  condition:  H  >  0.8  at  sea  level 
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SUMMARY 

A  method  for  designing  automatic  flight  control  systems  for  aircraft  that  have  complex  characteristics 
and  operational  requirements,  such  as  the  powered-lift  STOL  and  V/STOL  configurations,  is  presented.  The 
method  is  effective  for  a  large  class  of  dynamic  systems  that  require  multiaxis  control  and  that  have  highly 
coupled  nonlinearities,  redundant  controls,  and  complex  multidimensional  operational  envelopes.  The  method 
exploits  the  possibility  of  linearizing  the  system  over  its  operational  envelope  by  transforming  the  state 
and  control.  The  linear  canonical  forms  used  in  the  design  are  described,  and  necessary  and  sufficient  condi¬ 
tions  for  linearizability  are  stated.  The  control  logic  has  the  structure  of  an  exact  model  follower  with 
linear  decoupled  model  dynamics  and  possibly  nonlinear  plant  dynamics.  The  design  method  is  illustrated  with 
an  application  to  a  helicopter  autopilot  design. 


1.  INTRODUCTION 

Consider  in  general  terms  the  control-system  design  problem.  Let  us  take  the  usual  hardware/software 
model  of  the  problem  in  which  the  hardware  consists  of  the  plant  together  with  all  the  sensors  and  actuators 
which  are  connected  to  a  digital  computer,  and  in  which  the  software  embodies  the  complete  control  strategy. 
The  hardware  is  fixed;  we  may  change  only  the  software,  over  which,  however,  we  have  full  control.  So  one 
may  say  that  since  the  underlying  physical  process  is  to  remain  fixed,  only  its  representation  may  be  changed. 
If  this  point  of  view  is  taken,  then  much  of  the  control -system  design  problem  may  be  interpreted  in  terms 
of  transformations. 

This  paper  outlines  a  design  approach  that  is  being  developed  from  the  transformations  point  of  view, 
and  describes  an  application  to  the  control  of  a  helicopter.  This  approach,  first  outlined  in  Ref.  1,  has 

been  applied  to  several  aircraft  of  increasing  complexity,  and  the  completely  automatic  flight-control  system 

was  first  tested  on  a  DHC-6.  The  reference  trajectory  used  in  the  flight  test  exercised  a  substantial  part 
of  the  operational  envelope  of  the  aircraft.  Despite  disturbances  and  variations  in  plant  dynamics,  the 
system  performed  well  (see  Ref.  2).  Next,  the  technique  was  applied  to  the  Augmentor  Wing  Jet  STOL  Research 

aircraft,  the  successful  flight  tests  of  which  are  reported  in  Ref.  3.  Methods  for  providing  pilot  inputs  to 

this  design  were  "xamined  in  Ref.  4,  and  application  of  the  scheme  to  the  control  of  an  A-7  aircraft  for 
carrier  landing  and  testing  In  manned  simulation  is  reported  in  Refs.  5  ano  6.  The  design  method  is  currently 
being  applied  to  the  UH-1H  helicopter,  again  with  the  substantial  portion  of  the  operational  envelope  of  this 
aircraft  being  used. 

The  key  concept  of  the  approach  is  to  simplify  the  representation  of  the  plant  dynamics  by  means  of  a 
change  of  coordinates  of  the  state  and  control.  The  design  proceeds  in  three  steps.  First,  the  given  non¬ 
linear  system  -  possibly  time-varying,  multiaxis,  and  cross-coupled  -  is  transformed  into  a  constant,  decou¬ 
pled  linear  representation.  Second,  standard  linear  and  nonlinear  design  techniques,  such  as  Bode  plots,  pole 
placement,  LQG,  and  phase  plane,  are  used  to  design  a  control  law  for  this  simple  representation.  And  third, 
the  resulting  control  law  is  transformed  back  out  into  the  original  coordinates  to  obtain  the  control  law  in 
terms  of  the  available  controls. 

The  mathematical  foundation  for  the  approach  is  provided  by  modern  differential  geometry,  the  necessary 
and  sufficient  conditions  for  linearizing  have  been  established,  and  the  theory  is  given  in  Refs.  7-15. 


2.  CANONICAL  FORM 

Suppose  that  the  given  natural  representation  Si  of  the  physical  process  is  given  by  the  state  xi, 
control  Ui,  and  field  flt 

Xl  =  fl(xi.Ui)  (1) 

and  that  we  wish  to  change  Si  into  S2  with  state  x2,  control  U2,  and  field  f;, 

x2  *  f2(x2,u2)  (2) 

This  change  will  be  accomplished,  and  hence  a  large  part  of  the  design  problem  solved,  once  we  construct  the 
appropriate  transformations  of  the  state  and  control. 


x2  =  T ( x i )  (3a) 

ui  =  W(xi,u2)  (3b) 

which  relate  Si  to  S2  so  that  for  all  admissible  (x2,u2), 

(*i )f i[xi,W(xi ,u2 )]  *  f2[T(xi),u2]  (4) 

The  function  W  is  the  control  law. 

The  construction  of  the  transformation  (T,W)  is  often  greatly  simplified  by  the  introduction  of  an 
intermediate  canonical  representation  S0  as  shown  in  Fig.  I.  To  obtain  (Ti2,Wi2),  which  links  Si  to  S2, 
both  Si  and  S2  are  first  transformed  into  the  canonical  representation  S0.  Then 


Fig.  1.  Manipulation 
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In  the  design  procedure  being  described,  the 
Brunovsky  form  (Ref.  14)  is  taken  to  be  canonical. 

In  linear  theory  this  form  is  basic.  It  consists  of 
decoupled  strings  of  integrators  which  may  be  dia¬ 
grammed  as  shown  in  Fig.  2  where  each  dot  represents 
a  scalar  integrator. 

The  number  of  strings,  which  may  be  of  different 
lengths,  equals  the  number  of  controls  which  itself 
equals  the  number  of  Kronecker  indexes 
ki  i  kj  >  .  .  .  >  km.  The  lengths  of  the  ith  string 
is  given  by  ki  and  the  dimension  of  the  state  space 


’  ■  S 


Let  the  canonical  state  x0 
and  denote  the  canonical  field  f. 


e  Rn  control  u0  e  Rm, 


by 


x„  "  Ax 
o  oo 


(6) 


According  to  linear  theory  any  constant,  linear, 
controllable  system  may  be  viewed  as  a  nonsingular 
transformation  of  an  appropriate  Brunovsky  form. 

Thus,  if  Si  is  given  by  the  state  x;  e  Rn.  control 
ui e  Rm,  and  field 


Fig.  2.  Diagram  of  Brunovsky  form. 


x,  =  A,xi  +  B.u, 


(7) 


with  controllable  (Aj.Bj),  then  there  is  a  Brunovsky  form  that  can  be  transformed  into  Si  by  means  of  non¬ 
singular  transformations  (T,W  nonsingular) 


*i  *  T'lx0  (8a) 

Hi  *  Wu0  ♦  Qx,  (8b) 

Of  course,  S0  may  also  be  transformed  into  nonlinear  and  time-varying  systems  without  any  loss  of 
information  by  allowing  the  transformations  in  Eq.  (8)  to  be  nonlinear  mid  time-varying  but  still  nonsingular: 

ki  *  T‘‘(x0,t)  (9a) 

ui  •  W(x»,u0,t)  (9b) 

This  fact  gives  rise  to  our  design  procedure.  When  presented  with  a  nonlinear  system  Si,  the  first  step 
is  to  try  to  linearize  the  system  over  its  whole  operational  envelope  by  constructing  (T,W)  which  maps  Si 
into  S0.  Then  a  control  law  is  synthesized  for  the  much  simpler  S0.  Finally,  the  S0  control  law  is 
transformed  into  the  coordinates  of  Si  to  obtain  the  control  law  for  Si. 


3.  TRANSFORMABIlITf 


Fig.  3.  An  example  of  a  block  triangular  system. 


A  class  of  systems  particularly  amenable  to  this 
approach  has  the  following  form.  The  control  u  e  R"\ 
the  state  »  e  B”  >  R"  ■  .  .  .  >  R*  and  the  field  f 
is  without  transmission  zeroes  and  invertible.  An 
example  is  shown  in  Fig.  3.  In  this  example,  the 
state  x  e  R1”  ■  R"\  the  control  u  e  R1”,  and  the 
field  f. 


Xi  =  Fi(Xi,X;,t) 

X;  -  F,(Xi,X;,U,t) 


(10) 


and  F.  and  F.  are  invertible  relative  to  (x.-,xi)  and  (u,x;).  That  is,  functions  hi  and  hi  can  be  con¬ 
structed  so  that  if 


X:  -  hi(ki,Xi,t) 
u  *  h.(xi ,x; ,x; ,t) 


(ID 


x  i 


then 


F i[x i ,hi (x, ,x. ,t } ,t] 
Fi[xi ,xr ,h; (x, , x i ,x, ,t ) ,t] 


(12) 
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on  the  operational  envelope.  Because  of  the  form  of  Eq.  (10),  such  systems  will  be  called  block- 
triangular. 


For  this  example,  the  canonical  form  S0  has  m  Kronecker  indexes,  all  equal  to  2.  The  state 
x°  €  Rm  »  Rm,  the  control  u°  e  R™,  and  the  field. 


x ?  * 

X2  *  U° 


(13) 


The  map  linking  Eq.  (10)  with  Eq.  (13)  may  be  obtained  by  letting 
the  time-history  xf(t)  upstream  through  f  to  obtain  u(t).  Thus, 


xi  =  x?(t)  and  pushing,  as  it  were. 


Xi 

Xi 

x2 

X2 

u 


=  x? 

■  X?  *  x| 
s  hi (xi,xf ,t) 


ahj_ 

3Xi 


ahi 

ax2 


h2(xi,x2,x2,t) 


3hi 

at 


(14) 


In  general,  the  canonical  form  S0  of  a  block  triangular  Si  will  have 
equal  to  n/m  where  n  is  the  dimension  of  the  state  space  of  Si. 


m  Kronecker  indexes,  all 


This  procedure  of  constructing  the  linearizing  transformations  will  fail  if  Si  does  have  transmission 
zeroes.  In  that  case,  one  obtains  differential  equation  constraints  on  u,  thereby  destroying  its  status  as 
an  independent  control  variable.  Nevertheless,  such  systems  may  still  be  linearizable.  For  example,  the 
scalar  system 


is  linearized  by  the  transformation 

x!  =  Xi  +  \  (x,)2 


x!  =  x2 

X 3  a  X3 

u  =  u° 

On  the  other  hand  it  will  be  shown  that  the  system 


(15) 


(16) 


(17) 


Is  not  linearizable;  the  nonlinearity  in  this  case  is  intrinsic  and  cannot  be  removed  by  a  change  of  coordi¬ 
nates.  The  conditions  under  which  linearization  is  possible  are  summarized  next. 

Let  her",  ucn’,  and  the  field 


x  =  F(x,u) 


(18) 


There  are  four  conditions  for  this  system  to  be  linearizable.  First,  it  is  necessary  to  be  able  to  construct 
a  new  control  variable,  ♦  , 


*  =  h'*(x,u) 
u  =  h(x,») 


(19) 


so  that  «  enters  linearly  into  the  field; 


m 

F[x,h(x,$)]  =  f { x )  ♦  £  9, (x)*,  (20) 

i*i 

The  remaining  three  conditions  are  technical,  and  they  are  best  expressed  by  means  of  Lie  brackets  defined  as 
follows.  If  f  and  g  are  C”  vector  fields  on  Rn,  the  Lie  bracket  of  f  and  g  is 


[f  ql  .  13  f  .  II  g 
L  3x  3X  * 


(21) 


2.  Each  Cj  is  involutive  for  j  =  1,  2,  .  .  m 

3.  The  span  of  Cj  equals  the  span  of  Cj  n  C  for  j  *  1,  2,  .  .  . ,  m 

For  a  linear  field,  x  *  Ax  +  Bu,  the  spanning  condition  (1)  or  C  is  equivalent  to  control labi 1 i ty,  rank 
(B,  AB,  .  .  An_1B)  =  n.  The  other  conditions  are  automatically  satisfied.  The  new  coordinate  surface 
T j (x )  =  constant  in  a  plane  through  the  origin  in  the  old  state  space.  For  nonlinear  field,  Ti(x)  =  constant 
will  be  a  general  surface.  The  involutivity  condition  (2)  guarantees  that  this  surface  is  constructive  from 
local  conditions  (integrabi lity  theorem  of  Frobenius). 

Suppose  we  wish  to  transform  system  (17)  into  S0  with  k  =  3.  Here  the  set  C  *  { g , f f ,g], (ad: f ,g) } 
spans  R3.  But  the  Ci  -  (g»[f »g]*L9»[f *g]3)  also  spans  R3;  therefore,  system  (17)  is  not  transformable  into 
S0-  For  further  details  on  the  transformation  theory  see  Refs.  7-15.  Let  us  turn  our  attention  next  to  the 
control  structure  in  which  these  ideas  of  transformabi lity  may  be  implemented  in  practical  cases.  '• 


4.  EXACT  MODEL  FOLLOWER 

If  the  plant  Si  is  equivalent  to  a  system  S:  in  the  sense  that  each  can  be  transformed  into  the  other 
by  nonsingular  transformations,  then  one  may  construct  an  exact  model  follower  in  which  the  plant  Si  will, 
except  for  disturbances,  follow  exactly  the  system  S:,  which  is  interpreted  as  being  the  model.  Let  the 
system  representing  the  tracking  error  be  denoted  by  S3.  The  three  systems,  are  related  to  each  other  and 
to  the  Brunovsky  form  S0  as  shown  in  Fig.  4. 


Fig.  4.  Plant  Si,  model  S/t  and  regulator  $3. 
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Now  consider  the  structure  of  the  model  fol¬ 
lower  as  shown  in  Fig.  5.  There  are  five  subsys¬ 
tems:  model  servo,  regulator,  plant,  and  two 


transformations.  The  desired  system  behavior  is 
defined  in  the  model  servo.  The  model  servo  law 
may  be  nonlinear,  time-varying,  and  dynamic. 


The 

TW-map 

(Tz, 

, W2 s )  transforms 

the 

S2  system 

Xj  *  12 (X2  , U 2 , 

) 

(22) 

i  nto 

S», 

Xj  -  fa(Xa,U3j 

1 

(23) 

The 

TW-map 

( T  1  3 

,Wi 3 )  transforms 

the 

plant  Si 

X;  =  fi(x,,ui) 


into  S3 


(24) 


Fig.  5.  Structure  of  the  model  follower. 


Xj  =  fi(xa,Ua)  (25) 

That  is,  when  seen  through  the  TW-map  (Tu.Wia)  in  terms  of  (xa.Ua),  the  plant  looks  like  Eq.  (25);  which  is 
also  how  the  model  looks  through  the  TW-map  (Tj a ,WZ 3 ) . 

In  the  absence  of  disturbances  and  with  proper  initialization  of  the  model  (i . e. ,  x?(0)  =  T12[xj(C 
the  plant  will  follow  the  model  exactly  in  the  sense  that  the  error  defined  by 

eJ  =  *i  -  *?  (26) 

will  be  zero  for  t  >  0.  In  a  realistic  situation,  disturbances,  say,  d,  are  present,  and  they  are  controlled 
by  means  of  the  regulator  which  transforms  the  tracking  error  ej  into  corrective  control  Suj.  The  error 
dynamics  are  given  by 

Cj  3  fj(X3,Us)  -  f  3  ( x*^  ,u? )  (27) 


which  for  small  errors  simplifies  to 


4  3  e’  *  rut Su’  +  d 

In  particular,  if  Sa  is  chosen  to  coincide  with  S0»  so  that  fa  s  f0.  then  without  approximation, 

«o  =  Vo  +  ®oSuo  *  d  (28) 

It  may  be  noted  that  the  regulator  need  not  be  gain-scheduled;  that  function  is  accomplished  automatically 
by  the  TW-map. 

This  completes  the  outline  of  the  design  approach.  Consider  next  an  application  to  a  helicopter. 


5.  THE  PLANT-A  HELICOPTER 

The  helicopter  will  be  represented  by  a  rigid  body  moving  in  three-dimensional  space  in  response  to 
gravity,  aerodynamics,  and  propulsion.  The  state, 

x  =  (r,v,C,w)T  [KIM1.  50(3)  *  R’  (29) 

where  r  and  v  are  the  inertial  coordinates  of  body  center-of-mass  position  and  velocity,  respectively,  and 
C  is  the  direction  cosine  matrix  of  the  body-fixed  axes  relative  to  the  runway-fixed  axes  (taken  to  be 
inertial).  The  attitude  C  moves  on  the  sphere  S0(3).  The  body  coordinates  of  angular  velocity  are 
represented  by  <„. 

The  controls, 

u  *  (uM,uP)T  c  U  c  R>  x  R  (30) 

M 

where  u  is  the  three-axis  moment  control,  that  Is,  roll  cyclic  and  pitch  cyclic,  which  tilt  the  main-rotor 
thrust,  and  the  tail -rotor  collective,  which  controls  the  yaw  moment;  and  up  Is  the  main-rotor  collective, 
which  controls  the  main-rotor  thrust. 


The  effectively  12-dimensional  state  equation  consists  of  the  translational  and  rotational  kinematic  and 
dynamic  equations: 


r  *  v 


V  *  fF(x,u) 

t  3  S(u)c 


(31) 


*  f*(x,u) 


where  the  function  q  extracts  *  from  S(.)  »  dC^.  The 
required  time  derivatives  in  Eq.  (40)  are  computable  pro¬ 
vided  that  the  motion  (r,Ej)  is  generated  by  the  strings 
of  integrators  shown  in  Fig.  6  where  a  dot  represents  a 
scalar  integrator,  and  y5  e  R“  is  an  independent  control 
variable.  The  system  shown  in  Fig.  6  (Kronecker  indexes 
'4, 4, 2, 2;)  will  be  taken  as  the  canonical  model  of  the 
helicopter.  The  canonical  variables  will  be  denoted  by  y 
rather  than  x0  to  reduce  the  number  of  subscripts.  The 
transformation  and  feedback  that  change  the  natural  repre¬ 
sentation  (Eq.  (31))  to  the  canonical  representation  are 
approximately  the  following. 

The  coordinate  change,  y  =  T(x),  is  given  by 


y1  -  (y;,y‘)T  *  (r^r,)7 
y2  *  (y2,y2)7  •  (v,.*,)7 
y3  *  (yj.yj.yj.y3)7  -  (f^.EjW.r,)7 
y"  ■  (y?.y$.y!.yJ)T  -  r,  T 


Fig.  6.  Canonical  model  of  helicopter. 


cos  «,  =  Cjj/c,  sin  *  =  Cjj/c,  c  =  (c2,  +  c2,)1/2,  and  (c{j)  =  C 
The  control  variable  change,  u  *  w(x,ys)  is  defined  in  two  steps: 


■-{  n 


u  =  bM[r,v,C1«jt(ij,Vj )]  (43) 

The  effects  of  the  various  approximations  made  in  the  construction  of  these  transformations  are  relegated  to 
the  regulator. 


7.  MODEL  SERVO  AND  REGULATOR 

The  field  of  the  model  S2  is  chosen  to  be  canonical  as  defined  in  Fig.  6.  The  design  of  the  three 
trajectory  channels  of  the  model  servo  is  shown  in  Fig.  7.  There  are  four  3-axis  integrators.  Two  axes 
correspond  to  the  horizontal  strings  (rltr2)  in  Fig.  6.  The  third  axis  represents  the  vertical  (r3)  string, 
but  with  two  additional  smoothing  integrators.  The  exceedingly  simple  structure  of  the  field  (i.e.,  linear, 
decoupled)  greatly  simplifies  the  servo  design  process.  The  inner  loop  (a0,a0)  is  designed  to  be  an  acceler¬ 
ation  servo  whose  input  aj  is  the  sum  of  coarse  acceleration  cofimand  a*  from  the  coarse  coomand  gener¬ 
ator,  and  5a0  which  is  generated  by  the  outer  loop  to  smoothly  reduce  any  discontinuities  in  the  commanded 
position  and  velocity  vectors,  r*  and  v*,  respectively.  The  acceleration  servo  bandwidth  is  0.63  rad/sec. 

The  bandwidth  of  the  outer  loop  is  0.1  rad/sec.  Large  position  errors  are  reduced  at  the  rate  of  6  m/sec. 

The  heading  model  servo  is  shown  in  Fig.  8.  It  is  designed  to  have  two  scalar  integrators  corresponding 
to  the  Ej  string  in  Fig.  6.  The  heading  error. 


e^  *  cos  sin  ** 


sin  cos 


is  computed  in  the  q-block.  Block  S  represents,  together  with  the  integrator,  the  kinematic  equation 
of  t,. 

The  model  reference  state  y0  and  control  yo  in  Fig.  5  are  defined  (see  Figs.  6-8)  as  follows: 


(r1o-r!o> 


y0  "  (vio'v2o) 

y'o  1  faio,a!0’^i^'*'o^’rio^ 

*0  *  (ai0’a!0'“l0,V10^ 

>o  *  r*io»*jo,"»o'*io) 
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The  estimated  canonical  state  y  is  computed 
from  the  estimated  natural  state  by  means  of  the 
transformation  T  defined  by  Eq.  (42).  The  outer 
loop  of  the  horizontal  channels  (Fig.  9)  has  a 
bandwidth  of  0.3  rad/sec,  with  a  3  m/sec  large- 
error  reduction  rate  and  0.1-g  authority  limit. 

The  inner  loop  bandwidth  is  3  rad/sec.  The  verti¬ 
cal  channel,  shown  in  Fig.  10,  has  a  bandwidth  of 
0.63  rad/sec,  a  1.5-m/sec  large-error  reduction 
speed,  and  0.3-g  authority.  Finally,  the  heading 
channel  is  regulated  as  shown  in  Fig.  11,  where 
the  heading  error  is  given  by 

e  =  cos  4  sin  4^  -  sin  4  cos  4Q  (46) 

The  bandwidth  of  the  heading  regulator  is 
3  rad/sec. 


The  total  regulator  output,  4y5,  is  added  to  . 

the  open-loop  command,  y£,  resulting  in  the  total  1®‘ 

canonical  control,  y5.  it  is  then  transformed 

by  means  of  the  W-map  given  by  Eqs.  (42)  and  (43)  into  the  natural 
actual  plant. 


Regulator  -  the  heading  channel, 
control  u  which,  in  turn,  drives  the 


8.  SYSTEM  PERFORMANCE 


The  results  of  a  manned  simulation  are  summarized  in  this  section.  The  code  was  implemented  on  the  flight 
computer  to  be  used  in  the  flight  test,  and  the  mathematical  model  of  the  helicopter  (UH-1H)  was  driven 
through  the  actual  hydraulics. 


The  experimental  flightpath  is  defined  by  a  set 
cf  way  points,  segments  of  lines  and  helixes,  and  a 
..peed  profile,  as  shown  in  Figs.  12  and  13.  As  can 
be  seen  from  Fig.  12,  the  flightpath  is  a  closed 
curve.  The  time  dependence  is  shown  in  Fig.  13. 

The  experiment,  which  consists  of  automatically 
flying  this  trajectory,  exercises  the  system  over 
a  wide  range  of  flight  conditions.  The  helicopter 
is  taken  from  hover  (way-point  l  in  Fig.  12)  to 
high-speed  (60  m/sec)  accelerating,  turning,  and 
ascending  flight.  This  input  to  the  system  is 
coarse,  with  a  variety  of  discontinuities.  The 
required  smoothing  is  provided  by  the  model  servo 
discussed  in  the  preceding  section. 

For  the  data  presented,  the  helicopter  was 
flown  manually  to  the  point  *  marked  in  Fig.  12. 
There  the  automatic  system  was  engaged.  It  takes 
about  500  sec  for  the  helicopter  to  go  once  around 
the  flightpath.  Unlike  the  coarse  accelerations  in 
Fig.  13,  the  model  accelerations  are  smooth,  as  is 
the  vertical  velocity,  v,0.  The  second  panel  in 
Fig.  14  (labeled  "acceleration  error")  shows  the 
effects  of  the  neglected  parasitic  terms  on  acceler¬ 
ation.  The  acceleration  errors  are  quite  small  - 
less  than  0.05  g.  The  regulator  controls  these 
effects  by  means  of  position  errors.  The  resulting 
horizontal  error  is  less  than  2  m,  and  the  vertical 
error  is  below  0.5  m.  The  speed  error, 
ev  3  v  -  ,v0|.,  is  below  0.5  m/ sec. 

Thus,  the  performance  of  the  design  in  the  sim¬ 
ulation  tests  was  good,  and,  at  this  writing,  flight 
tests  are  in  progress. 


1 


Fig.  12.  Experimental  flightpath  shown  in 
horizontal  and  vertical  planes. 
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Summary 

Computerized  synthesis  techniques  of  modern  control  theory  are  in  widespread  use,  but  a 
number  of  fundamental  design  problems  still  remain.  We  call  them:  the  design  specifica¬ 
tions  problem,  the  free  design  parameter  problem,  the  plant  complexity  versus  controller 
simplicity  problem  and  the  dirty  design  environment  problem.  A  design  procedure  which 
comes  close  to  solving  these  design  problems  is  recommended:  It  is  an  iterative  design 
technique  using  a  performance  index  vector  which  provides  a  systematic  guidance  for  the 
designer  to  take  care  of  multiple  design  objectives  simultaneously  and  individually.  As 
a  design  tool  unconstrained  parameter  optimization  is  used.  A  practical  application  is 
briefly  reported:  The  design  of  a  robust  control  loop  for  a  fighter  aircraft  where  42 
performance  criteria  of  9  different  sorts  have  been  considered  simultaneously. 


1 .  Introduction 


The  ultimately  achievable  performance  of  a  control  system  is  limited  by  hardware  con¬ 
straints  such  as  the  dynamics  of  the  plant,  the  actuators,  and  the  sensors.  The  actually 
achieved  performance  is,  in  addition,  a  product  of  control  design:  The  specification  of 
a  controller  structure  and  the  tuning  of  the  controller  parameters  determine  how  well  the 
design  objectives  are  met  within  the  given  limitations.  Hence,  in  order  to  improve  con¬ 
trol  performance  one  should  improve  the  control  design  as  well  as  the  underlying  design 
procedures . 

Design  is  a  trade-off  between  various  competing  objectives.  These  objectives  reflect 
the  properties  a  good  system  should  satisfy.  They  are  rarely  complete  and  quantitatively 
specified  at  the  outset.  Rather  they  are  an  open  list  and  formulated  in  qualitative  terms 
such  as:  The  control  system  should  be 

-  "fast  and  smooth"  in  response  to  reference  inputs,  there  should  be 

-  "small  static  and  dynamic  errors"  due  to  disturbances .  The  system  should  have  a 

-  "good  stability  margin"  in  order  to 

-  "tolerate  'large'  parameter  variations  and  modelling  inaccuracies."  But  the  system 

should  also  have  a 

-  "well  limited  bandwidth"  and  "low  feedback  gains"  in  order  to  be 

-  "insensitive  with  respect  to  measurement  noise".  Furthermore  control  action  should  be 

-  "well  within  actuator  saturation  limits"  and  so  on  ... 

The  designer  has  to  satisfy  all  these  objectives  in  the  best  possible  way.  How  can 
this  be  achieved? 


2.  Problems  when  Using  Synthesis  Techniques  of  Modern  Control  Theory 

Modern  control  theory  using  state  feedback  and  observers  e.g.  for  linear  optimal  con¬ 
trol,  pole  placement,  deccfcipling,  and  disturbance  accomodation,  provides  much  insight  into 
the  analysis  and  synthesis  of  linear  systems.  Combining  this  conceptual  insight  with  the 
numerical  efficiency  of  a  digital  computer  results  in  a  set  of  useful  tools  to  assist  the 
design  process.  But  although  such  computerized  control  synthesis  techniques  are  in  wide¬ 
spread  use,  a  number  of  fundamental  design  problems  still  remain: 

The  Design  Specifications  Problem:  A  synthesis  technique  of  modern  control  theory 
usually  focuses  on  one  type  of  design  specification  only  (e.g.  pole  location;  decoupling; 
disturbance  accomodation)  and  is  based  on  an  exact  numerical  specification  (e.g.  all  pole 
positions,  exact  decoupling,  exact  asymptotic  disturbance  accomodation  for  prespecified 
frequencies).  This  requests  the  designer  to  map  all  design  objectives  onto  a  single  type 
of  mathematical  criterion  (e.g.  pole  placement)  which  often  narrows  too  much  the  designer's 
overall  view  of  system  performance.  Furthermore  an  exact  quantitative  specification  of 
design  objectives  is  rarely  possible  in  practice.  What  about  a  combination  of  different 
types  of  criteria  to  cover  the  overall  system  performance?  What  about  specifying  bounds 
rather  than  specifying  exact  numerical  values  for  performance  measures? 

The  Free  Design  Parameter  Problem:  The  free  design  parameters  in  the  Riccati  formalism 
are  the  weighting  coefficients  in  the  cost  functional.  How  to  choose  these  weighting  coef¬ 
ficients  systematically?  How  to  choose  pole  locations  as  the  free  design  parameters  in  a 
pole  placement  approach?  What  about  additional  free  parameters  in,  say,  a  full  order  state 
observer?  To  solve  these  decision  problems,  an  iterative  design  loop  is  necessary  based 
on  an  analysis  of  the  overall  system  performance  and  notably  the  plant  limitations.  Is 
there  a  strategy  available  for  systematical ly  reaching  an  overall  compromise? 


The  Plant  Complexity  vs.  Controller  Simplicity  Problem:  Modern  control  theory  provides 
analytical  relations  between  the “structure'  oT  the  plant7  and  the  structure  of  a  suitable 
controller.  This  means:  Simple  plant  models  yield  simple  controllers,  complex  plant  models 
yield  complex  controllers.  What  about  simple  controllers  for  complex  plants  which,  as  we 
know,  often  do  very  well  in  practice?  We  need  an  efficient  design  procedure  for  simple 
controllers  taking  into  account  realistic  and  thereby  rather  complex  plant  models.  Why 
not  use  parameter  optimization? 

The  Dirty  Design  Environment  Problem:  Modern  contro1  theory  yields  neat  solutions  for 
neat  problems.  Unfortunately,  the  design  environment  in  practice  is  rather  dirty.  What 
about  plant  nonlinearities,  parameter  uncertainties,  changing  characteristics  and  control 
saturation?  Can  we  handle  such  effects  directly  without  the  need  to  transcribe  them  into 
the  linear  framework  of  modern  control  synthesis? 

These  design  problems  when  using  synthesis  techniques  of  modern  control  theory  are 
conceptual  ones:  They  are  consequences  of  a  search  for  analytical  solutions,  where  the 
computer  serves  only  the  purpose  of  fast  numerical  evaluations  of  (complex)  analytical 
relations.  They  cannot  be  removed  by  using  faster  computers  or  by  improving  the  man- 
computer  interface.  What  we  need  for  control  design  is  a  multi-objective  design  procedure 
with  a  systematic  decision  strategy  as  a  complement  to  control  theory  and  the  use  of 
computers  as  fast  searching  devices  for  finding  a  "best"  solution  in  a  (nonlinearly 
defined)  set  of  possible  candidates. 

In  order  to  handle  multiple  design  objectives  in  a  systematic  way,  they  have  to  be 
formulated  by  mathematical  criteria.  This  is  a  question  of  control  theory,  where  either 
the  state  space  or  the  frequency  domain  may  turn  out  to  be  more  appropriate  for  quanti¬ 
fying  a  particular  design  objective.  Control  theory  also  helps  to  decide  what  kind  of 
design  criteria  have  to  be  included  for  a  special  design  purpose  and  it  yields  some  qual¬ 
itative  insight  into  conflicting  demands.  But  control  theory  yields  no  strategy  to  handle 
design  as  a  multiple-criteria  decision  problem  as  it  naturally  results  out  of  the  multi¬ 
tude  of  different  design  objectives  which  have  to  be  considered.  Hence  we  are  looking  for 
a  systematic  framework  which  guides  the  designer  to  cope  with  a  multiple-criteria  control 
design  problem. 


3.  Systematic  Design  Via  a  performance  Index  Vector  and  Parameter  Optimization 

A  design  procedure  which  comes  close  to  solve  most  of  the  above  mentioned  design  prob¬ 
lems  has  been  suggested  in  [11.  It  has  proven  to  be  very  useful  in  various  practical 
designs  and  can  be  summarized  as  follows: 

Given  a  plant,  and  given  a  suitably  chosen  controller  structure  with  free  parameters 
k  *  Ikj,...fk  ]  the  design  problem  is  to  determine  suitable  values  foi  k. 

In  order  that  the  design  can  proceed  in  a  systematic  fashion  it  is  necessary  that  all 
design  objectives  are  taken  care  of  explicitly  in  the  design.  Therefore,  every  design 
objective  shall  be  rated  quantitatively  by  means  of  a  suitable  performance  index  J^(k). 

A  performance  index  J^(k)  is  called  suitable  if  JN(k’)  <  J^(kM)  means  that  k'  satisfies 

the  i-th  control  objective  better  than  k"  does,  and  if  J.(k)  is  a  sufficiently  smooth 
function . 

For  ease  of  notation  we  define  the  performance  vector  J(k)  =  l  J 1  <  k]  , .  .  .  , J^( k)  I . 

Moreover,  for  any  two  real  vectors  x,  y  we  say  that  x  <  y  if  for  all  components  x-  s  y. 
and  x  ♦  y.  11 


Iterative  Technique  for  a  Systematic  Design 


The  design  technique  is  iterative,  where  each  design  iteration  (the  v-th,  say)  com¬ 
prises  two  steps: 

Step  1 :  Choose  a  vector  of  design  parameters  cv  (c^v  >  o)  such  that 

J(kv‘')  <  cv  <  cv'’.  u 


Step  2:  Find  kv  and  aQ  <  1  such  that 

<  vc‘v-  (2) 

The  design  iteration  is  initialized  by  using  an  initial  guess  k°  for  the  controller 
parameters  and  by  taking  c°  sufficiently  large. 

In  step  I  of  every  design  iteration,  cv  has  to  be  chosen  where  (1)  provides  a  well 
defined  margin.  This  choice  determines  tKe  design  direction.  Step  2  then  provides  the 
margin  for  the  next  design  iteration. 

It  is  desirable  that  this  margin  be  as  large  as  possible,  i.e.  a  should  be  as  small 
as  possible.  0 


t  ll.it 


V ;  tot  t  ?n.'  .  -  r  h  .lc  <  i  ^.’i  itcr.i!  iu;  we  have  t  rom  '  i  , 


l.o.  wo  have  a  mono t on  1 v a  1 1 v  decreasing  sequence  ot  design  vectors  and  the  performance 
vector  has  hoc <. me  les>  than  all  ot  them.  this  establishes  the  systematic  behaviour  of 
the  design  process. 


lies  ign  tool 

Basically,  any  method  which  is  able  to  perform  step  :  of  the  design  iterations  can 
serve  as  a  design  tool,  ifere  we  shall  locus  on  a  method  which,  in  addition,  tends  to 

make  a  as  small  as  possible, 
o  * 

The  smallest  value  cf  i  ^  satisfying  1 ; k )  •  i  v  is  given  ias  a  function  of  k)  by 

a  I  k  l  =  max  i  -1  k  i  i  (-11 

u  -  i<i<i.  1  1 

Since  a  ik)  is  not  continuously  differentiable  everywhere,  we  consider  a  smooth,  i.c. 
at  least  0  twice  continuously  differentiable  approximat ion  tiki  instead,  where 

,  L 

a i k )  *  -  1 n  .  exp • t J ■  «  k ) / c •  I  ?  1 

i  =  l 

and  0  is  arbitrary.  It  can  he  verified  that 

,  L  djtkj 

iik)  ■  a  ik)  ♦  t  in  ..  exp  i  o  l - -  -  a  (kill  ‘  *> > 

0  -  i=l  c  .  '  0 

i  to  nee  0  <  .t  -  a.,  <  i  In  l.)/c,  i.e.  a  can  be  nu.de  as  close  to  <*o  as  desired  by  choice  of 

;  in.*  it.  l  n  im  i ;  at  ion  of  aik)  .for  example,  by  applying  Powell's  method  for  function  mini¬ 
mi,  at  ion  without  calculating  derivatives  1  -  1 1  can  now  Ik*  used  as  a  design  tool  for  per¬ 
forming  step  2  in  each  design  iteration. 

I  he  sequence  of  design  iterations  finally  terminates  when  the  minimi za r ion  of  \<kl 

results  in  a  k‘  with  .i  i  k v )  >  1. 

o  - 

As  in  all  parameter  optimization  problems  there  is  a  possibility  of  local  minima. 

J  lie  re  fore ,  instead  of  using  efficient  local  optimization  algorithms  such  as  Towel  l's  |  , 

one  may  .is  well  use  global  optimization  algorithms  such  as  random  search  algorithms. 
However,  the  latter  arc  known  to  be  less  efficient. 


Note  also  that  the  use  of  optimization  algorithms  which  assume  that  the  function  to  he 
minimized  is  twice  continuously  differentiable  (which  most  efficient  local  algorithms  Jo), 
requires  that  the  performance  indices  themselves  must  be  twice  continuously  differentiable 
Ihis  imposes  a  certain  restriction  on  the  mathematical  formulation  of  performance  indices. 


•1 .  Practical  Application  Considerations 

The  above  design  procedure  using  a  performance  index  vector  and  parameter  optimization 
solves  most  of  the  design  problems  stated  in  section  2: 

lhc  design  procedure  provides  a  systematic  framework  to  take  care  of  multiple  design 
objectives  simultaneously  and  individually.  The  design  objectives  can  be  formulated  by 
criteria  of  different  kind  either  in  state  space  or  frequency  domain.  Hence  the  design 
specifications  problem  can  be  tackled  in  the  most  direct  way.  Howe'er,  the  design  proce¬ 
dure  does  not  provide  a  priori  guidelines  what  design  objectives  are  appropriate  for  a 
particular  design  problem.  It  remains  in  the  designer's  responsibility  to  decide  what 
design  criteria  he  shall  use.  This  decision  must  be  based  on  his  knowledge  of  control 
theory  and  the  operational  requirements  he  has  to  satisfy. 

The  design  procedure  provides  a  systematic  guidance  for  the  designer  to  cope  with  the 
free  design  parameter  problem:  for  each  individual  perfomance  index  J  there  is  associ¬ 
ated  a  free  design  parameter  c^  which  can  be  chosen  by  the  designer  within  a  well-defined 

nuugm.  Typically,  one  starts  with  sufficiently  large  values  for  the  design  parameters 
and  then  successively  reduces  them  so  as  to  improve  certain  criteria  while  keeping  possi¬ 
ble  deteriorations  of  others  in  tolerable  bounds.  Whatever  choice  c.v  in  *he  given  margin 
is  taken,  it  is  always  guaranteed  that  K  £  c. '  and  hence  a  possible  degradation  of  the 
performance  index  J ^  is  well  bounded.  If  =  J^(kv_I)  is  chosen,  then  an  improvement  of 
'J  j  is  guaranteed  provided  only  that  such  an  improvement  is  possible  at  all  at  the  expense 

of  degrading  other  performance  indices.  This  allows  to  explore  the  design  poss ib  i  1 i t  les  , 
and  to  reach  a  desirable  trade-off  between  competing  objectives,  step  by  step. 


In  each  step  it  is  the  responsibility  of  the  designer  to  decide  upon  the  design  di¬ 
rection,  i.e.  which  performance  index  shall  be  improved  and  what  is  a  permissible  expense 
in  degr.Jing  other  performance  indices.  The  design  procedure  then  guarantees  a  step  by 
step  monotonic  improvement  in  the  direction  specified  by  the  designer.  The  admissible 
margins  of  the  design  parameters  which  are  updated  in  each  design  iteration,  yield  some 
information  how  easy  or  difficult  it  is  to  reach  the  individual  design  objectives.  Hence 
this  design  procedure  makes  it  possible  to  explore  the  system’s  limitations  in  control 
des ign. 

The  design  approach  is  well  suited  to  deal  with  practical  controller  realisation  con¬ 
straints.  This  is  a  consequence  of  using  parameter  optimization  as  a  design  tool  instead 
of  using  an  analytical  control  synthesis  technique.  There  is  no  "controller  simplicity 
vs.  plant  complexity  problem"  as  we  called  it  earlier.  The  designer  can  specify  the  con¬ 
troller  structure  at  will.  He  is  free  to  combine  control  considerations  with  technical 
realizability  constraints.  This  freedom,  however,  calls  much  at  the  designer's  experience 
and  physical  insight  into  the  type  of  system  to  be  controlled.  Furthermore,  in  view  of 
the  numerical  convergence  properties  of  parameter  optimization,  one  also  has  to  take  some- 
care  in  mathematically  specifying  the  controller  structure,  i.e.  in  parameterizing  the 
control  Law:  There  must  not  be  redundant  parameters.  In  addition,  the  free  parameter  to 
be  optimized  should  have  the  same  order  of  magnitude,  i.e.  proper  scaling  may  be  necessary. 
On  the  other  hand,  the  freedom  to  specify  a  controller  structure  makes  it  possible  to 
develop  a  proper  structure  in  an  iterative  process:  Start  with  a  simple  structure,  say  a 
{’- I  controller,  and  extend  it  successively  bv  additional  dynamic  degrees  of  freedom,  i.e. 
use  a  higher  order  controller,  if  the  design  iterations  yield  no  further  improvement  with 
the  formerly  chosen  structure.  In  this  way,  one  can  explore  the  trade-offs  between  con¬ 
troller  simplicity  and  control  system  performance . 

The  design  procedure  is  open  to  handle  complex,  nonlinear  systems.  There  is  no  con¬ 
ceptual  necessity  for  linearized  or  low  order  plant  models.  But  there  may  be  computer 
time  limitations:  In  view  of  parameter  optimization  the  performance  indices  have  to  be 
evaluated  very  often  and  hence  sufficiently  fast.  For  nonlinear  systems  there  are  usually 
no  analytical  volutions  for  such  evaluations,  rather  the  performance  indices  nave  to  be 
computed  on  the  basis  of  system  simulations.  This  limits  the  complexity  of  system  models 
to  be  used  by  the  speed  of  available  computers  and  the  efficiency  of  available  simulation 
softwa  re . 

lor  practical  applications  of  the  design  procedure  via  performance  index  vector  and 
parameter  optimization,  a  user-oriented,  modular  design  software  package  Rl.M\G  |M  is 
available.  This  design  package  has  been  successfully  applied  in  solving  various  non¬ 
standard  design  p  oblems.  One  such  application  is  briefly  described  in  the  next  section. 


Appl  i  :  at  ion  hxample:  Robust  Control  Loop  Design  for  a  Fighter  Aircraft 

This  application  is  well  documented  in  |4J.  Here  we  shall  give  a  brief  overview  of  the 
problem  to  be  handled,  the  sort  and  number  of  performance  indices  used  and  the  final 
resul t . 

Control  problem:  For  a  fighter  aircraft  (type  F-4C)  a  stability  augmentation  system 
shall  he  designed  to  improve  the  longitudinal  handling  qualities.  This  shall  be  achieved 
with  a  fixed  gain  controller  which  covers  the  whole  flight  envelope  without  gain  sched¬ 
uling.  Furthermore  only  pitch  rate  i  :;)»  the  variable  to  he  controlled,  shall  he  used  for 
feedback.  As  structure  of  the  controller,  a  third-order  compensator  has  been  specified, 
where  ten  constant  controller  pa-  meters  k.  are  to  be  assigned  i figure  I).  Fhc  longitu¬ 
dinal  motion  of  the  aircraft  is  modeled  by  a  linearized  second  order  short  period  motion 
description  of  the  aircraft  plus  a  first  order  actuator  system.  In  the  flight  envelope, 
five  j extreme. I  flight  conditions  shall  be  considered  (figure  >). 

he r f o rmance  Criteria:  The  following  performance  criteria  are  specified  for  each  of  the 
f  i  vc  selected  H  i gTTt  cond  i  t  ion s  . 

iL’,Jl.^'itury_criteriu_iur_stepresponse^ 
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Here  m  is  a  desired,  normalized  step  response  modeled  by  a  second-order  sytem,  denote 
different  time  scales  for  each  individual  flight  condition. 
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(fere  *  i  is  the  associated  rate  of  elevator  motion. 
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SUMMARY 

This  study  follows  a  previous  author's  work  (Ref,  l)  where  a  new  laser  probe 
was  presented  as  a  detector  of  air  mass  wind  shear  perturbation  ahead  of  the  vehicle; 
the  probe  informations  are  applied  to  a  lateral  digital  autopilot  input  generating  the 
necessary  sideslip  corrections  minimizing  trajectory  errors  due  to  the  wind  shear 
effects.  Here  the  results  of  the  state  variable  decoupling  theory  are  applied  to  decou¬ 
ple  the  roll  and  yaw  lateral  motion  as  required  to  satisfy  independently  maneuvering 
and  trajectory  following  specifications.  The  rudder  channel  gains,  yielding  the  decou¬ 
pling  process  and  forcing  the  vehicle  transient  behaviour  to  reproduce  the  desidered 
response,  are  computed  and  the  resulting  mult i- input-mult i-out-put  autopilot  feedback 
structure  is  described.  The  software  and  hardware  aspects  of  the  digital  autopilot, 
including  the  laser  package  and  microprocessors  resolving  the  desidered  control  laws, 
are  presented  and  the  system  simulation  results  are  shown  for  the  evaluation  of  the 
system  dynamical  behaviour  in  response  to  a  wind  shear  perturbation. 

LIST  OF  SYMBOLS 

0  sideslip  angle 

p  roll  rate 

r  yaw  rate 

<p  bank  angle 

ip  heading  angle 

0,  drift  angle 

crosstrack  angle 
VRf  heading  reference 

w  lateral  wind  component 

uy  control  variable  for  the  subsystem  S  (u  ,  <p  ) 

u  control  variable  for  the  subsystem  S  (u  ,r) 

r  reference  input  for  the  subsystem  S  ( u  ,  <p  ) 

r  reference  input  for  the  subsystem  S  (u  ,r  ) 

r  r  r 


1.  INTRODUCTION 

In  Ref.l  has  been  shown  the  basic  information  regarding  the  design  of  an 
airborne  laser  doppler  sensor  allowing  the  simultaneous  measurements  of  the  two-dimen¬ 
sional  body  axes  components  of  the  airmass  velocity  in  a  unperturbed  point  ahead  of 
the  vehicle  to  predict  the  wind  shear  onset  just  in  advance  to  correct  its  effects  and 
reduce  consistently  the  tracking  errors  due  to  this  cause.  The  essential  kinematic 
requirement  in  the  design  of  the  wind  velocity  was  to  gather  the  wind  velocity 
information  sufficiently  in  advance  to  allow  the  autopilot  to  carry  out  the  corrective 
actions,  generally  involving  high  yaw  rates,  provided  by  the  autopilot  rudder  channel. 
The  laser  velocimeter  signal,  together  with  heading  error  information,  is  employed  to 
generate,  at  the  rudder  channel  input,  a  signal  with  magnitude  proportional  to  the 
crosstrack  angle  which  is  continuously  forced  to  a  null  value  by  a  feedback  process. 
This  means  to  drift  the  vehicle,  in  presence  of  wind  shear  gradient,  to  an  angle 
appropiate  to  align  continuously  the  ground  speed  vector  with  a  variable  reference 
direction.  Since  the  roll  and  yaw  motions  are  coupled  in  the  original  control  system, 
where  they  are  adjusted  for  satisfactory  tracking  characteristics,  the  modified  control 
strategy  may  result  inadequate  to  cope  simultaneously  the  tracking  and  wind  shear 
requirements.  The  design  objectives  have  been  achieved  decoupling  the  roll  and  jaw 
motions  in  the  original  control  system  and  adjusting  separately  the  bank  angle  and 
yaw  rate.  In  the  following  sections  the  theory  of  the  state  variable  decoupled  linear 
system  is  applied  to  the  lateral  dynamics  of  the  Shuttle  Orbiter  vehicle. 


2.  ROLL- YAW  DECOUPLING 

The  theory  on  state  variables  decoupled  linear  system  (Ref ,2)  has  been 
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applied  to  decouple  the  roll  and  yaw  modes  of  the  Shuttle  Orbiter  lateral  dynamis.  A 
generalized  program  has  been  prepared  to  design  decoupled  flight  control  systems  and  the 
basic  theoretical  equations  involved  in  it  and  the  numerical  results  for  the  case  treated 
are  summarized  in  the  following* 

The  basic  vehicle  lateral  dynamic  is  described  by  a  fourth  order  state  equation 
involving  two  inputs: 

x(t)=Ax(t)+Bu(t)  (  l  ) 

with  state  and  control  vectors  defined: 

x  <t)  =  [  £(t),  p(t),  r(t),  p(t)  ]  (2) 

u  (t)  -  I  ua(t),  ur(t)  1  (3) 

The  numerical  state  and  control  matrices  for  the  case  treated  are  shown  in  Table  1;  the 
(2x4)  selection  matrix  is  introduced  to  define  the  output  vector: 

£  (t)  *  C  x  (t)  ^  [  r(t),  <p  ( t)  ]  T  (4) 

consisting  of  the  basic  state  variables,  the  yaw  rate  and  the  bank  angle  which,  when 
associated  respectively  to  the  control  variables  u  and  u^,  will  provide  the  two  deside- 
red  decoupled  subsystems: 

sa  =  1  V  ^  1  Sr  =  [  up,  r  ]  (5) 

The  first  step  in  decoupling  the  two  subsystems  (5)  is  to  define  the  subsystems  order: 

p .  =  d .  +  1 
1  1 

where  d.  is  the  decoupling  index: 


=  min  (j  :  C. 


j  =  0, 1,2,3 


As  result  of  the  application  of  these  relations,  che  two  subsystems  (5)  appear  respecti¬ 
vely  as  a  first  and  second  order  systems.  The  decoupling  process  applied  to  the  system 
(  l)  will  be  bsoed  on  the  control  law: 

u(t)=Kx{t)+Gr(t)  (6) 

where  r  (t)  is  an  input  vector  applied  externally  to  the  decoupled  system.  The  (2x2) 
input  matrix  G  and  the  (2x4)  feedback  matrix  K  are  defined  in  the  following  form: 


G  =  B  “  1 


B=  l  Cj  A 

d 

*  *  I  c,  a 


K  =  -  B 

d  T 
C_  A  1  B  ] 
d  +1  T 


The  control  law  (6)  solves  the  decoupling  problem  if  and  only  if  the  matrix  B  is  not 
singular,  as  has  been  proved  for  the  case  at  hand.  The  numerical  values  of  the  G  and  K 
matrices  are  indicated  in  Table  1.  In  Fig. I  is  depicted  the  feedback  structure  of  the 
control  system  allowing  the  two  lateral  state  variables  r  and  q>  to  be  regulated  inde¬ 
pendently  by  the  the  autopilot  rudder  and  aileron  channel  in  response  to  the  respective 
sot  point  values.  The  closed  loop  representation  of  the  decoupled  system  will  be: 

x(t)  =  A  x  (t)  +  B,  v  (t)  (8) 

v  a  —  .  .  a  — 

l(t)  =  C  x  (t) 

A  =  A  +  B  K 
d 

B  =  B  G 
d 

The  integrator  poles  of  the  system  ( 8)  must  be  now  located  to  the  desidered  positions  in 
the  complex  plane  satysfying  the  transient  response  charact erist ics  proposed  in  the  design. 
The  objective  has  been  achieved  in  two  steps;  in  the  first  one  the  system  ( 8)  by  means 
of  the  linear  transformation: 

z  (t)  =  T  x  (t)  (9) 

is  transformed  in  a  system  having  the  following  state  matrix: 


At  =  diag  1  (AU’  A22 


)  i  ‘J 


where  the  submatrices  A^  and  A  ,  in  phase  variable  forms,  are  respectively  the  state 

matrices  of  the  subsystems  S  ana  S  and  A  is  an  additional  row  resulting  from  the  de- 

r  3  r 

finition  of  the  transformation  matrix  T  having  the  same  dimension  of  the  state  matrix 
Ad  Fq .  (  S ) : 

r  =[T1|x2iTrlT  ;  T,  -c,  ,  t2=!c2  ;  c2Al 


T 


I 


—  *1 
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The  row  Tp,  not  influencing  the  subsystem  dynamic,  is  chosen  to  be  linearly  independent 
from  the  other  rows  and  avoiding  as  well  the  matrix  singularity;  a  subroutine  in  the 
computer  program  will  generate  the  transformation  matrix  T  with  such  additional  row.  The 
structure  of  the  transformed  system  becomes: 

l(t)  =  \  i(0  +  r(t)  (  It) 

i(t)  =  Cfc  z(t) 

The  linear  transformation  described  in  Ref .5  is  applied  to  the  system  (12)  to  obtain 
the  subsystems  transfer  functions  in  frequency  domain  making  easy  task  to  program  the 
integrator  poles  shift  into  the  desidered  locations  in  the  complex  plane.  As  a  result 
of  such  computational  treatment,  including  the  inverse  transformation  in  the  original 
coordinate  x,  the  control  for  the  decoupled  system  satisfying  the  dynamic  requirements 
will  be  expressed  by  the  equation: 

v(t)  =  K  r(t)  +  F  x(t)  (  12) 

s  o  — 

where  the  ( 2x2)  gain  matrix  K  and  the  feedback  matrix  F  are  computed  along  with  the 
poles  positioning  numerical  process.  From  Eq.(8)  and  (13?  it  is  apparent  that  the  mathe¬ 
matical  process  yielding  the  regulation  of  the  decoupled  system  modifies,  as  depicted 
in  Fig. 2,  the  gain  and  feedback  matrices  given  in  Eq.(7)  as  follows: 

6*  -  Ks  G  K'  -  K  +  Ks  GFo  <‘3> 

In  terms  of  the  new  matrices  G‘  and  K'  the  control  law  for  the  decoupled  and  regulated 
system  can  be  written  as: 

u(t)  =  lua(t)  1  ur(t)l  =  G*  r(t )  +  K'  x(t)  ( 14) 

allowing  to  keep  the  same  blocks  representation  given  in  Fig.l.  Eq.(l4)  can  be  developed 
in  the  scalar  form: 


u  (t) 
a 


4 

2 

j- 


k'  . 
1,  J 


.(t)  + 


2 

2 

i  = 


*1,1 


;(t) 


ur(t) 


4 

2  k;  i  + 

j-i  2,3  3 


2 

2 

i=l 


52,i 


:(t) 


(IS) 


Eq.(  16)  indicates  that  the  requested  control  laws  can  ben  implemented  as  a  sum  of  the 
partial  products  including  the  constant  gains  appearing  as  elements  of  the  computed 
matrices  G'  and  K!,  the  external  forcing  functions  and  the  whole  set  of  the  feedback 
state  variables.  A  microprocessor  has  been  employed  to  generate  the  control  functions 
(15)  processing  the  feedback  and  set  point  data.  The  constant  coefficients  k'  and  g', 
the  numerical  values  of  which  for  the  flight  condition  considered  in  this  study  are  in¬ 
dicated  in  Table  2,  are  stored  in  the  microprocessor  memories. 


TABLE  2  -  Autooilot  sains 

Orbiter 

Shuttle  in  landing 

configuration 

Sensor 

variable 

Subsystem  Sa 

Subsystem  S 

r 

Lat .Accel . 

0 

0,00319 

2, 1545 

Roll  Rate  Gyro 

P 

2, 1611 

-6,8768 

In  Rate  Gyro 

r 

2,2833 

11,9183 

Vertical  Gyro 

9 

3,4778 

-10,995 

Aileron  Input  Trasd. 

r 

-3,4773 

10,995 

Rudder  Input  Trasd. 

r 

r 

-3,0012 

-10,3029 

3.  SYSTEM  DESCRIPTION 

Three  basic  sections,  the  laser  package,  the  autopilot  controller  and  the 
autopilot  aileron  and  rudder  channels,  can  be  recognized  in  the  system  block  represen¬ 
tation  in  Fig«4*  The  basic  autopilot  is  configured  with  the  aileron  channel  regulating 
the  bank  angle  as  the  primary  lateral  state  variable  with  the  rudder  channel  operating 
fundamentally  as  a  yaw  damper  unit;  the  crossfeed  gain  (K  ),  set  on  the  aileron  error 
driving  signal,  is  employed  to  generate  a  rudder  channel  £nput  forcing  function  requi¬ 
red  for  turn  coordination.  In  the  laser  implemented  version,  conceived  as  a  whole  digi¬ 
tal  structure,  microprocessors  are  included  in  the  control  loop  to  carry  out  the  com- 

required  for  the  laser-doppler  signals  conditioning  and  for  the  generation 
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of  the  control  laws  providing  the  decoupling  and  regulating  process  summarized  in  the 
preceding  sections.  The  wind  shear  control  is  obtained  applying  to  the  subsystem  (u^,r) 
the  reference  signal  given  by  the  relation: 

ur<‘>  =  Kcr  ^(t)  +  K, (  0,  (t)  (  16) 

indicating  that  a  portion  of  the  aileron  command  signal  (r^)  controlling  the  bank  angle 
is  fed  to  the  rudder  channel  in  order  to  satisfy  the  turn  coordination;  the  other  con¬ 
tribution  is  given  by  the  crosstrack  angle  measured  by  the  laser  system  to  obtain  the 
wind  shear  control.  When  the  reference  signal  (l6)  is  applied  to  the  decoupled  lateral 
control  subsystems,  the  vehicle  is  forced  to  track  the  desidered  trajectory  in  coordina¬ 
te  turns  and  to  perform  simultaneuosly  sideslip  maneuvers  to  cope  with  the  wind  shear 
effects*  In  the  following  sections  some  of  the  design  details  of  the  overall  digital 
system  are  described. 


4.  LASER  PACKAGE 

Two  10-watts  Argon-ion  laser  trasmitter-receiver  coaxial  units  described  in 
Ref,  1  are  employed  in  a  two  dimensional  laser  doppler  velocimeter  working  at  4880  A 
coherent  light  wavelenght  for  lateral  wind  velocity  component  measurements.  Computations 
based  on  probe  volume  spatial  resolution  yielding  an  acceptable  signal  to  noise  ratio 
in  natural  contaminated  atmosphere,  indicate  as  feasible  the  value  of  the  front  lens 
radius  (6,38  cm,)  and  the  location  (35  « • )  of  the  probe  volume  ahead  of  the  vehicle 
nose,  where  the  laser  package  was  supposed  to  be  installed.  The  laser  beams  angle  res¬ 
pect  to  the  reference  optical  axis  was  made  automatically  variant  by  means  of  an 
adaptive  servosystem  to  obtain  the  best  dual  mode  operations  with  various  seeding  par¬ 
ticle  sizes.  In  the  evaluation  of  the  backscattered  radiation  efficiency,  various 
atmospheric  trasmittance  values,  ranging  from  clear  air  to  moderate  smoggy  situations, 
were  taken  into  consideration;  the  corresponding  backscattered  optical  flux  originated 
at  the  probe  illuminated  section  crossed  by  1  ji  m  diameter  seeding  particle  was  estima¬ 
ted  in  order  of  magnitude  of  0,3  10**  ^  watt.  For  the  assumed  values  of  the  optical  effi¬ 
ciency  (  \%)  in  the  collecting  light  system  and  considering  a  $%  quantum  efficiency  in 
detection,  the  current  measurable  at  the  output  of  a  photomultiplier  with  an  internal 
gain  of  10^  was  found  in  the  range  of  1,5  •10”^  to  6,7,  10“ ^  Amp,,  depending  on  the 
trasmittance  considered;  the  correspondent  number  of  the  observed  fringe  lines  is 
varying  from  20  to  52,  These  results  has  been  considered,  at  this  stage  of  the  research, 
acceptable.  In  the  proposed  range  for  the  measurable  wind  velocity  magnitude,  the  resul 
ting  doppler  frequency  assumes  values  from  0,132  to  2,65  MHz  and  the  total  time  spent 
by  the  particle  crossing  the  probe  volume  was  estimated  in  the  range  of  20  ♦  0,3^3 
psec  , 

A  digital  wind  velocity  processor  performs  the  computation  of  the  lateral 
mean  wind  velocity  computation  based  on  zero  crossing  counting  of  the  pulses  generated 
by  a  Schmitt  trigger  excited  by  the  doppler  bursts  appearing  at  the  photomultipliers 
output.  The  sensitivity  to  the  fluctuation  existing  in  the  doppler  signal  can  be  regu¬ 
lated  adjusting  the  hysteresis  trigger  voltages  to  obtain  the  desidered  s/N  ratio  for 
accurate  measurements.  The  observation  time  ( 1  /i  sec,)  relative  to  the  counting  pro¬ 
cess  was  chosen  referring  to  the  minimum  number  of  the  observed  fringes  and  maximum 
doppler  frequency.  The  number  of  pulses  counted  at  each  cycle  (8)  has  been  established 
on  the  ground  of  the  maximum  error  in  counting  originated  by  the  a synchronism  of  the 
doppler  originated  and  reference  pulse  trains.  The  error  in  time  measurements  with  a 
clock  of  256  KHz  correspond  to  an  error  of  0,3^  in  wind  velocity  computation.  Following 
the  blocks  sketched  in  Fig, 5,  the  wind  velocity  data  from  the  counter  are  transferred 
directly  into  the  memory  locations  of  an  8-bits-2  MHz  clock  microprocessor  performing 
the  computation  of  the  mean  value  of  wind  velocity  based  on  four  data  observations. 

This  processor  performs  also  the  drift  angle  computation  adding  it  to  the  heading  error 
data  to  obtain  the  crosstrack  angle  value  requested  to  implement  the  wind  shear  control 
strategy.  The  total  time  requested  for  computing  and  1/0  operations  is  in  the  order  of 
1,8  msec,;  this  time,  which  includes  the  time  for  the  digital  to  analog  conversion,  is 
considered  as  the  up-dating  period  for  the  crosstrack  angle  informations  at  the  auto- 
pi  lot  input , 

5.  AUTOPILOT  DIGITAL  CONTROLLER 

As  mentioned  previously,  the  autopilot  controller,  treated  in  this  study,  is 
a  microprocessor  computing  the  control  laws  expressed  by  the  Eq,  (15)  which  allows  to 
decouple  the  original  system  state  variables  and  regulate  the  transient  response  of 
the  resulting  decoupled  system  (5),  The  autopilot  sensors  output,  together  with  the 
reference  set-point  voltages  are  applied  to  a  parallel-in-serial-out  (  8x  l )  analog  mul¬ 
tiplexer  (MPX),  Each  of  the  MPX  inputs  are  enabled  to  be  translated  to  the  8-bits  analog 
to  digital  converter  under  the  adressing  assignements  given  by  a  3-bits  preset  counter 


working  on  a  clock  frequency  chosen  to  satisfy  the  requirements  imposed  by  the  signal 
reconstruction  based  on  the  closed  loop  autopilot-vehicle  bandwidth.  In  this  particular 
application  involving  gust  and  flutter  control,  the  clock  frequency  for  the  MPX 1 s  coun¬ 
ter  was  established  at  the  value  of  160  Hz.  The  data  transfer  from  the  MPX  to  the  analog 
to  digital  converter  and  from  the  converter  to  the  microprocessor  data  bus  is  carried 
out  entirely  under  the  control  of  the  software  implemented  as  a  part  of  the  microproces¬ 
sor  interrupt  program.  Since  the  total  uncertainty  in  the  control  laws  generation  de¬ 
pends  predominantly  on  the  uncertainty  in  the  control  gains  assignement ,  particular  at¬ 
tention  was  paid  in  choosing  the  length  of  the  word  representing  a  coefficient  in  the 
control  algorithm*  The  criterion  adopted  at  this  regard  was  rcfered  essentially  to  the 
maximum  allowable  percentage  error  ( 1$)  in  locating  the  integrator  poles  in  the  complex 
plane  as  requested  in  the  decoupling  and  regulating  processes;  this  error  was  correla¬ 
ted  to  the  minimum  number  of  bits  in  the  numerical  representation  of  the  closed  loop 
control  gains.  For  the  specific  case  treated  the  minimum  word  length  for  the  requested 
accuracy  was  evaluated  in  13  bts.  The  coefficients  of  the  control  algorithms  are  entered 
in  the  8-bits  Intel  8080  microprocessor,  employed  in  laboratory  applications,  as  a  lo- 
bits  words  in  two  sets  of  8  bits  each,  representing  respectively  the  most  and  the  least 
significant  bits.  Since  the  measured  state  variables  have  a  direct  memory  access  in  the 
microprocessor  as  a  8-bits  data,  the  software  implementing  the  control  algorithms  yields 
products  of  16-bits  multiplicand,  transferred  temporarely  in  couples  of  8-bits  registers, 
by  an  8-bits  multiplicator ;  the  8-bits  partial  products  are  entered  into  the  accumulator 
while  the  multiplicator  bits  are  shifted  out.  By  means  of  an  appropiate  use  of  the  memo¬ 
ry  stack,  the  sum  of  the  partial  products  are  made  available  in  sequence  in  the  accumula¬ 
tor  at  the  end  of  each  multiplication.  The  final  result  is  translated  to  the  output  port 
from  the  accumulator  under  the  program  control.  The  control  algorithms  requires  for  each 
of  the  two  subsystems,  6  multiplications  and  6  additions.  To  perform  the  arithmetic  and 
miscellaneous  operations,  the  last  ones  including  the  interrupt  and  i/O  operations,  a 
total  time  of  3>9  msec,  is  required. 

This  time  interval  consisting  of  the  acquisition  time  for  a  complete  set  of 
input  data  and  the  above  mentioned  computing  time,  defines  the  sampling  time  ( 10. 15 
msec.)  for  the  digital  process  considered  in  this  study;  it  represents  the  time  elapsed 
to  generate  the  requested  control  laws  based  on  the  laser  velocimeter  informations. 

The  control  signals  governing  the  decoupled  subsystems  are  translated  from  the 
latch  register  at  the  microprocessor  output  to  the  8-bits- 10  volts  full  scale  voltage 
digital  to  analog  converter;  the  conversion  is  carried  out  at  the  rate  of  its  internal 
clock  (10  MHz.)  with  a  resolution  compatible  with  the  maximum  admissible  error  in  the 
aerodynamic  control  surfaces  positioning  and  well  within  the  precision  capability  of  the 
overall  digital  system  precision. 

The  autopilot  servosystem  consists  of  hydraulic  actuators  with  servovalves 
regulated  by  means  of  variable  reluctance  stepping  motors.  The  pulse  train  to  the  stator 
windings,  is  generated  by  an  electronic  controller  which  is  essentially  a  rate  multi¬ 
plier  unit  working  on  piecewise  constant  analog  voltages  in  the  range  of  l <>♦ 3 8  10~^ 
volts  and  generating,  at  its  output,  pulse  trains  at  a  recurrence  frequency  varying 
between  100-1000  pulse  per  second;  these  pulse  trains  are  properly  sequenced,  through 
the  control  logic  unit,  to  the  motor  stator  windings  forcing  the  stepping  motor  in  the 
slew  range  varying  from  0,87  to  8,7  rad/sec. 


6.  SYSTEM  SIMULATION 

The  purpose  of  the  system  simulation  was  essentially  to  test  the  process  per¬ 
formed  by  the  Intel  8080  microprocessor  employed  in  the  laboratory  applications  and 
programmed  in  its  assembler  language  to  solve  the  numerical  algorithms  proposed  to 
decouple  and  regulate  the  system  state  variables  and  to  obtain  the  wind  velocity  infor¬ 
mations  by  means  of  an  hardware  emulation  of  the  wind  velocity  computer.  No  provisions 
are  made  to  simulate,  at  this  research  stage,  the  laser  velocimeter  requiring  data  from 
extensive  electro-optical  laboratory  tests.  The  overall  digital  system  was  simulated  in 
a  Univac  1100  computer  employing  a  microassembler  program  allowing  the  control  algorithms 
to  be  entered,  for  the  part  regarding  the  microprocessor  simulation  including  all  1/0 
operations,  in  assembler  language  while  Fortran  programming  was  used  for  the  continuous 
part  of  the  system.  The  forcing  function  for  the  system  was  based  on  the  wind  shear  mo¬ 
del  considered  by  the  author  in  a  previous  work  (Ref.  4).  The  system  simulation  results 
are  discussed  in  the  next  section. 


7.  DISCUSSION  OF  THE  SIMULATION  RESULTS 

The  time  response  of  the  decoupled  system,  with  gains  regulated  as  indicated 
in  Table  2,  to  r  step  input  (r  =0)  is  shown  in  Fig.7»  while  the  response  to  the  r 
(r  ™0)  step  input  is  given  in  F?g.8,  From  these  results  is  clearly  apparent  the  satis¬ 
factory  effects  of  the  decoupling  process  and  the  acceptable  approximation  achieved 
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in  the  reproduction  of  the  desidered  subsystem’s  dynamical  behaviour.  In  Fig. 9  the  sys¬ 
tem  rensponse  to  a  step  command  applied  to  the  r*  input  with  crossfeed  branch  closed  is 
shown,  indicating  that  in  coordinated  turns,  the  yaw  response  is  dictate  only  by  the 
crossfeed  relation  existing  between  the  aileron  and  rudder  forcing  functions. 

For  the  evaluation  of  the  system  performances  under  wind  shear  perturbations, 
the  r  input  command  and  the  heading  error  were  set  to  zero  allowing  the  rudder  command 
to  be  proportional  to  the  drift  angle  computed  from  laser  data.  The  wind  shear  perturba¬ 
tion  was  modelled  as  linear  time  function  with  lateral  wind  component  intensity  varying 
at  the  rate  of  5t 23  m/sec^;  this  shear  model  is  assumed  applied  at  the  probe  volume  and 
measured,  at  the  sampling  rate  of  0, l6 5  HKHz . ,  by  the  laser  velocimeter  during  the 
vehicle  progression  toward  it;  the  correspondent  signal  at  the  wind  velocity  computer 
input  was  a  sequence  of  variable  frequency  doppler  bursts.  The  simulation  result  shown 
in  Fig. 10  indicates  that  the  yaw  rate  and  the  drift  angle  become  increasingly  larger  as 
the  vehicle  approaches  the  probe  volume  spot  reaching,  at  the  time  of  crossing,  80$  of 
the  predicted  values  for  a  full  correction  of  the  wind  shear  perturbation.  Consider  now 
this  result  from  the  point  of  view  of  the  wind  shear  predicting  capability  of  the  pro¬ 
posed  system.  A  significant  parameter  at  this  regard  may  be  the  lead  margin,  defined 
as  the  time  difference  between  the  vehicle-autopilot  reaction  time  and  the  time  spent  to 
cover  at  the  specified  airspeed,  the  distance  from  the  vehicle  present  position  to  the 
point  observed  by  the  laser  velocimeter.  For  the  autopilot-vehicle  reaction  time  is  in¬ 
tended  the  sum  of  the  vehicle  yaw  mode  time  constant  and  the  time  required  to  generate 
the  control  laws*  Clearly  the  defined  lead  margin  must  be  negative  to  ensure  that  the 
vehicle  is  capable  to  react  adequately  to  the  wind  shear  pert urbat ions  detected  by  the 
laser  probe;  furthermore  greater  is  its  magnitude  better  will  be  the  operative  system 
capability  in  correcting  the  wind  shear  effects.  The  lead  contribution  introduced  in  the 
basic  feedback  control  system  has  been  seen  to  allow  the  drift  angle  to  reach  8o£  of  the 
desidered  value.  This  result  is  specifically  referred  to  an  upper  limit  imposed  to  the 
time  constant  relative  to  the  first  order  subsystem  (u  ,r);  in  the  design  this  upper  li¬ 
mit  was  set  at  the  value  of  0,183  sec. 

A  larger  lead  margin  can  be  reached  choosing  a  lower  time  constant  and  redu¬ 
cing  the  control  laws  computing  time;  the  first  solution  implies  an  increase  in  auto¬ 
pilot  gains  and  rudder  travel  and  the  second  requires  more  advanced  microprocessor 
characteristics.  Further  simulations  carried  out  with  different  time  constants,  indica¬ 
te  that  a  time  constant  of  0, 1  sec,  yields  an  acceptable  lead  margin  with  a  gain  set 
still  realizable  from  the  point  of  view  of  hardware  implement  at ion;  the  larger  control 
displacements  involved  in  yaw  corrections  have  been  minimized  ascribing  to  the  autopilot 
controller  the  function  of  an  optimal  controller  synthetized  by  the  algorithm  treated 
in  Ref,  3,  Implementing  this  new  configuration,  implying  some  increase  in  hardware  com¬ 
plexity,  the  resulting  lead  margin  allows  the  drift  angle  to  reach  90^  of  the  value  for 
fall  correction  at  the  probe  volume  spot.  It  is  author’s  opinion  that  the  choice  of  a 
time  constant  somewhere  in  between  the  above  considered  values,  one  can  satisfy  th- 
wind  shear  requirement  with  a  moderate  increase  in  hardware  complexity.  Provision  were 
made  also  using  high  speed,  real  time  processors  where  multiplications  and  additions 
are  carried  out  in  a  time  more  than  50^  less  of  the  time  required  by  the  present  micro¬ 
processor  generation;  considering,  as  an  indication,  a  multiplication  time  in  the  order 
of  70  n  sec.,  value  indicated  as  already  achieved  in  current  literature,  the  total 
. omputing  time  would  be  reduced  at  the  order  of  a  millisecond,  that  is  four  time  less 
than  the  time  taken  by  the  laboratory  set  up  used  in  this  study.  It  is  reasonable  to 
say  that  the  use  of  a  microprocessor  of  a  new  generation  can  improve  consistently  the 
lead  capability  of  the  proposed  laser  implemented  system. 

8.  CONCLUSION  AND  AREAS  OF  FUTURE  RESEARCHES 

The  present  study  indicates  the  feasibility  of  a  flight  control  system  made 
active  in  controlling  the  wind  shear  effects  with  the  contribution  of  a  laser  doppler 
velocimeter  which,  when  judged  on  the  basis  of  the  data  available  at  this  phase  of  the 
research,  looks  very  promising  <<s  a  predictor  sensor  of  the  airmass  dynamics  ahead  of 
the  vehicle.  The  decoupling  and  regulating  process  implemented  by  a  microprocessor  as 
a  computing  unit  working  on  the  feedback  data  and  reference  sign<{.'  including  the  laser 
measurements,  becomes  essencial  in  controlling  simultaneously  trailing  and  wind  shear 
corrective  yaw  maneuvers  during  an  high  speed-high  precision  approach  to  land  under 
critical  environmental  disturbances,  problem  tipically  interesting  the  terminal  phase 
of  the  Orbiter  Shuttle  mission.  Further  author’s  works  in  this  research  area  are  in 
preparation;  the  subjects  treated  regard  the  use  of  a  high  speed  real  time  microproces¬ 
sor  to  solve  the  algorithm  for  model  following  optimal  control  applied  to  the  decoupled 
system  and  the  design  of  a  self-adaptive  process  optimizing  the  detection  of  the  laser 
doppler  backscattered  quantum  efficiency  in  a  atmosphere  of  low  seeding  concentration. 
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If  a  flight  navigation  system  haa  to  oparata  independently  of  ground  atationa  or 
satellites,  it  haa  to  ba  updated  by  acquiaition  of  ground  data.  Thia  paper  propoaaa 
poaltion-f ixing  by  automated  detection  of  rivers,  roada ,  and  other  traffic  routea  in  the 
viaual  inage  underneath  the  aircraft.  Thaae  patterns,  undiatorted  even  if  viewed  from  low 
altitudes  are  detected  by  an  elactrooptlcal  sensor,  which  correlates  the  laage  with  a 
rotating  slit.  As  this  sampling  pattern  is  aatched  to  line-shaped  image  patterns,  traffic 
routes  are  detected  in  highly  structured  background  in  spite  of  weak  contrast.  For 
position  fixing  data  of  detected  traffic  routes  are  fed  to  a  micro  computer  on  board,  to 
be  compared  with  stored  map  data  of  traffic  routes.  This  approach  forced  us  to  develops  a 
suitable  nonlinear  filtering  method,  yielding  an  optimal  estimation  of  the  real  position 
and  thereby  the  position  offset  of  a  dead  reckoning  syatam. 


1 .  Introduction 

Automated  image  analysis  and  pattern  recognition  in  production  plants  as  in  military 
equipment  is  often  obstructed  by  disturbances  of  the  image  pattern,  noise  of  its 
background,  lack  of  contrast,  and  lnhomogenelties  of  the  camera  target.  Additional 
difficulties  are  often  found  in  processing  the  wealth  of  pictorial  information  with 
reasonable  computer  power  in  reasonable  time  at  the  site  of  the  industrial  or  military 
plant  or  on  board  an  aircraft.  To  cope  with  these  problems,  the  system  described  in  this 
paper  adapts  elactrooptlcal  scanning  to  the  contours  of  the  image.  This  yields  a  novel 
sensor  for  detecting  weak  contours  in  highly  structured  background.  In  the  first  part  of 
my  paper  I  shall  introduce  the  concept  of  the  so-called  contour-sensor.  The  second  part 
contains  its  application  to  image  supported  navigation.  This  section  will  covert 

-  The  unsupervised  acquisition  of  digital  map  data  from  airphotographs  or  maps  by  the 
contour-sensor . 

-  The  in-flight  detection  of  roads  and  rivers  by  a  contour-sensor  of  the  same  type. 

-  Map  matching  by  a  recursive  filter,  which  compresses  all  information  from  previous 
updates  into  $  state  variables. 

-  Experimental  results  of  flight-simulations. 


2.  Acquisition  of  contour  data  by  a  contour  sansor 

The  common  procedure  for  image  processing  starts  by  bringing  the  entire  image  into  a 
computer  after  scanning  it  in  a  fixed  raster.  These  yields  two  problems) 

-  A  large  amount  of  information  has  to  be  transferred,  stored,  and  processed. 

-  Sampling  noise  is  generated  by  any  fixed  raster  converting  the  smooth  contour  in  fig.  1 
into  a  staircase. 

we  find  rather  good  examples  in  newspapers.  Who  has  not  seen  rastered  images  from  which 
evgn  our  excellent  visual  system  proves  unable  to  extract  any  essential  contour)  they  have 
«.  been  ruined  by  noise.  A  finer  sampling  raster  reduces  sampling  noise  but  increases 
computer  workload.  It  is  well  known  that  biological  systems  can  afford  highly  parallel 
processing.  But  even  those  systems  reduces  image  information  before  transferring  it  to  the 
visual  cortex. 

What  can  we  learn  from  the  biology?  It  is  not  very  efficient  to  ask  which  image  data  are 
really  needed,  after  all  of  them  have  been  brought  into  the  computer.  Its  much  better  to 
think  previously,  and  to  control  the  sensor  in  such  a  way,  that  only  really  needed 
Information  will  be  selected.  The  sensor  is  than  adapted  to  the  expected  Information  in 
the  sense  of  the  theorie  of  optimal-filtering.  So  we  need  a  controlable  preprocessor. 

As  relevant  information  for  image  analysis  and  classification  is  mainly  contained  in 
image  contours,  we  developed  an  electrooptical  preprocessor,  called  *  contour-sensor ' , 
which  adapts  the  sampling  pattern  to  the  image  contours.  Contours  are  defined  rather 
simply) 

-  A  contour  is  a  line  shaped  pattern,  formed  by  the  maxima  of  the  gradient  of  average 
intensity  (or  other  statistical  moments ) . 

Averaging  on  either  side  of  a  contour  should  cover  a  wide  area  to  eliminate  drop-outs  and 
other  local  disturbances  of  the  pattern  and  its  background.  On  the  other  hand  it  should 
not  extend  to  regions  xitslde  the  homogeneous  image  area,  which  might  be  limited  e.g.  by 
the  horizontal  contour  in  the  upper  part  of  fig.  2. 

The  sampling  or  integration  area  should  thus  cling  to  the  contour  narrowly  and  should 
follow  the  contour  as  long  as  possible.  Sampling  strips  FI  and  F2  on  either  side  of  the 
contour  are  each  scanned  by  one  scan  line  of  an  image-dissector-camera.  Averaging  of  the 
video  signal  during  the  scan  of  FI  or  F2  can  be  done  by  analog  electronics,  reducing 
computer  input  data  to  one  value  per  scan  area.  The  difference  between  these  data  yields 
the  gradient  of  average  intensity. 

The  task  is  to  choose  the  sampling  areas  properly,  to  adapt  them  to  a  contour  which  has 
yet  to  be  detected.  We  have  to  adapt  to  the  contour-parameters 

-  curvature 

-  direction  and 

-  position  of  a  contour. 
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These  must  be  done  using  as  much  a-priori-knowledge  as  available  from  previous  measure- 
■ents  taken  of  the  sane  image.  Hypotheses  on  the  further  course  of  a  contour  and  other 
contour  elements  must  be  based  on  this  knowledge  and  must  be  tested  by  subsequent 
measurements. 

These  are  the  basic  principles  of  our  system,  as  opposed  to  sampling  the  entire  image  in  a 
fixed  raster  and  transmitting  all  information  to  the  computer* 

-  Selection  of  information  which  is  most  probably  significant  reduces  computer  workload. 

-  Adaptation  to  the  expected  information  improves  the  systmaa  detectivity. 

The  amount  of  available  a-priori-knowledge  will  be  zero  in  a  pure  search  process.  In  this 
case  we  vary  direction  and  position  of  a  stall  rectangular  scanning  area  continuously  by 
shifting  a  starshaped  scanning  pattern  across  the  image.  For  tasks  like  image  supported 
navigation  we  use  a  contour-sensor  imaging  the  pattern  onto  a  mechanical  rotating 
reticle.  An  integration-lense  collects  all  light  penetrating  the  reticle  on  a  single 
phototransistor.  In  this  way  the  contour-sensor  performs  a  two-dimensional  correlation 
with  a  wedge-shaped  slit  and  computes  the  tangential  component  of  the  correlation-gradient 
during  rotation  of  the  slit.  The  slit  eliminates  image  defects  by  averaging  many  pixlee. 
As  only  one  photoelement  is  used  there  are  no  disturbances  by  inhomogenious  sensitivities 
of  electrooptlcal  targets.  After  electrooptlcal  conversion  the  signal  is  sampled  256  times 
during  one  rotation  of  the  slit.  This  yields  an  angle  resolution  of  1.4  degree.  When  the 
slit  crosses  a  contour  the  difference  between  two  samples  marks  the  gradient  of  the 
Intensity.  The  moment  of  crossing  yields  the  orientation  of  the  contour. 

Fig.  3  shows  an  image  taken  by  electron-raster-microscope  from  monoatomlc  steps  in 
Fa-mono-cristals,  made  visible  by  gold-coating.  This  preparation  technique  produces  a 
random  pattern  which  arranges  itself  in  an  ordered,  though  far  from  continuous  straight 
line  at  the  location  of  a  step.  This  image  has  bean  scanned  with  a  star-distance  of  1/2o 
star  radius.  In  an  angular  histogram  the  directions  of  ths  bundles  of  straight  lines  are 
prevailing  clearly  in  background  nolss  due  to  artefacts  and  accidental  line  arrangements 
of  gold  pixels.  This  example  haa  been  selected  to  deatonstrate  the  contour-sensors  ability 
to  detect  very  imperfect  contours  with  weak  contrast  in  highly  structured  background. 


3.  Image  supported  navigation 

If  a  flight  navigation  system  has  to  operate  independently  of  ground  stations  or 
satellites,  it  has  to  be  updated  by  acquisition  of  ground  data.  This  paper  proposes 
position-fixing  by  automated  detection  of  rivers,  roads,  and  other  traffic  routes  in  the 
visual  image  underneath  the  aircraft.  Flying  at  low  altitudes,  perspective  distortions 
will  be  generated  in  the  region  of  ground  elevations  or  buildings.  This  complicates 
areal-correlation  from  airframes  with  maps  carried  on  board.  However  roads  and  other 
lineshaped  picture  elements  are  undistorted  exactly  when  the  optical  axis  of  the  vertical 
looking  contour-sensor  crosses  them.  These  pstteme,  undistorted  even  if  viewed  from  low 
altitudes  are  detected  by  our  senaor  system,  which  correlates  the  image  with  a  rotating 
slit.  The  motion  of  the  scanning  star  across  the  visual  field  results  from  the  flight 
manoeuvres  automatically.  As  this  ssmpllng  pattern  is  matched  to  line-shaped  image 
patterns,  traffic  routes  are  detected  in  highly  structured  background  in  spite  if  weak 
contrast.  From  these  measurements  the  sensor-electronics  computes  the  angular-orientation 
of  traffic  routes. 
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To  demonstrate  the  detectivity  of  the  contour-sensor  ve  follow  a  continous  scan  line  of 
the  aerial  photograph  fig.  4.  Detected  roads  are  indicated  by  an  arrow.  No  segmentation 
problem  arises,  even  if  two  roads  are  measured  simultaneously  by  the  scanning  star. 
Contours  of  forests  and  other  area  contours  are  suppressed  completely  by  proper  filtering. 
The  continuous  scan  simulates  a  flight  path.  Data  on  position  and  direction  of  several 
roads  are  compared  with  memory  data  to  compute  the  actual  position  for  navigation 
updating. 

From  low  altitudes  these  terrain  features  will  be  discernible  under  moat  weather  condi¬ 
tions  by  a  passive  sensor,  with  electrooptical  light  amplification  for  night  missions. 
Dense  fogbanks  only  will  interrupt  ground-sight  for  short  intervals.  Mlcrowave-radio- 
metry  promises  passive  all-weather-navigation  capability,  tn  this  way  the  system  may  be 
Installed  in  helicopters,  aircrafts,  or  cruise  missiles  and  is  specially  suitable  for 
flights  in  low  altitudes. 


4.  Navigation  updating 

For  position  fixing,  data  on  detected  traffic  routes  are  fed  to  a  micro-computer  (LSI  11) 
on  board,  to  be  compared  with  stored  map  data  of  traffic  routes.  These  map  data  may  have 
been  acquired  by  a  ground  based  sensor  of  the  same  type  from  maps  or  airphotographs.  The 
flight-path  may  be  presceduled  for  unmanned  missiles  or  choosen  arbitrarily  by  the  pilot 
during  his  mission,  provided  it  crosses  traffic  routes  occasionally.  As  the  contour- 
sensor  extracts  roads  and  rivers  only,  the  digital  reference  map,  needed  for  navigation 
updating  and  carried  on  board,  has  to  contain  these  patterns  only.  Their  position  and 
orientation  is  stored  as  map  data  from  the  computer  in  an  index-sequential  data-base  where 
the  orientation  arves  as  index.  This  image  reduction  minimizes  storage  demand  in  such  a 
way  that  the  whole  area  of  mission  can  be  memorized  for  navigation  updating  in  midcourse 
and  terminal  guidance. 

For  in-flight  navigation  we  need  a  start  position  and  a  dead  reckoning  system.  The  actual 
reference  map  is  roughly  selected  with  regard  to  the  dead  reckoning  position.  The  unsui¬ 
table  drift  error  of  the  navigation  system  causes  a  displacement  between  the  real  and  the 
dead  reckoning  position.  When  the  aircraft  crosses  a  traffic  route  the  contour-sensor 
delivers  informations  about  a  lineshaped  pattern.  The  comparison  of  the  detected  contour 
with  the  reference  map  yields  a  position  line  probably  crossed  by  the  aircraft.  Due  to  the 
drift  error  this  line  will  not  pass  through  the  predicted  position.  In  this  way  we  get  a 
lire  as  hypothesis  for  the  real  position  in  relation  to  the  dead  reckoning  position. 

Taking  miemeasuraments  of  approximately  the  width  of  the  traffic  route  in  account  we  get  a 
line  with  a  gaussian  profile,  a  so-called  gausslan-wall .  Lets  continue  the  flight.  In 
course  of  time  the  position  information  carried  by  the  position  line  will  get  more 
uncertain,  due  to  the  continuing  drift.  We  take  this  into  account  by  broadening  the 
gausslan-wall  continuously.  Crossing  the  next  traffic  route,  the  contour-sensor  delivers  a 
further  gausslan-wall  as  likelihood-distribution  of  the  momentary  real-position.  From  the 
last  and  all  former  distributions,  an  a-posterlori-likellhood  can  be  constructed.  The 
cempound-distrlbution  arises  from  a  superposition  of  all  gausslan-walls.  This  can  be  done 
by  multiplication  or  logarithmic  addition  of  the  single  distributions.  The  basic  require¬ 
ments  for  the  superposition  are  e  translation  of  all  former  distributions  in  coorespon- 
dence  with  the  flight  progress  and  a  broadening  according  to  the  drift  error.  It  can  be 
shown,  that  the  local  maximum  of  this  compound-distribution  yields  an  optimal  estimation 
of  the  real  position  and  thereby  the  position  offset  of  the  dead  reckoning  system. 


The  question  may  arise,  why  we  don't  process  the  measurements  with  the  well  proved 
technique  of  Kalaan-f iltering.  The  profile  of  the  distribution-function  is  specified  by 
the  orientation  of  the  gaussian-wall  produced  from  the  traffic  route  as  input  signal. 
Consequently,  in  our  approach,  signal  and  noise  are  extremely  correlated.  This  violates  a 
critical  basic  requirement  of  Kalman-f i  1  tering .  This  forced  us  to  develops  a  suitable 
nonlinear  filtering  method.  We  succeded  in  describing  the  whole  history,  that  means  the 
current  compound-distribution  by  a  state-vector  with  only  five  scalar,  linearly  indepen¬ 
dent  components.  When  the  contour-sensor  delivers  a  new  measurement  the  state-vector  can 
be  actualized.  This  yields  a  recursive  presentation  of  the  proposed  nonlinear  optimal- 
filtering.  Besides  position  lines  point-position  data,  for  example  the  start  position,  can 
be  included  as  the  intersection  of  two  orthogonal  gauaslan-walls.  Since  we  actualise  the 
state-vector  for  every  measurement,  it  doesn't  matter  if  we  include  an  incorrect  gaussian- 
wall  sometimes  or  if  we  ignore  a  traffic  route.  These  mistakes  of  the  contour-sensor, 
encountered  in  spite  of  the  optimized  contour  detection,  are  suppressed  by  the  nonlinear 
filtering,  described  above.  With  a  lot  of  flight  simulations  we  could  demonstrated  the 
efficiency  of  the  algorithms  implemented  on  a  microprocessor  and  the  high  accuracy  of  the 
entire  system. 

Let  me  present  seme  performance  data  of  our  system  to  you,  finally. 

-  Slngle-board-ccmputer  PDP  11/23  with  64  KB  memory 

-  Reference  map  resident  in  the  main-memory 

-  Position  updating  in  25o  ms 

-  Simulated  flight-velocities  up  to  28oo  km/h 

-  Updating  independently  from  alterations  of  illumination  and  vegetation 

-  Updating-error  less  than  2  m. 


t iq  4 1  'Flying'  accross  an  aerial  photograph  along  the  black  lines, 
the  sensor  has  no  segmentation  problems  when  two  roads  are 
caught  simultaneously  by  the  scanning  star. 


detected  contour* 
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SUMMARY 

An  intelligent  tracking  algorithm  for  an  1R  imaging  missile  seeker  and  a  method  of  evaluating  its  performance  in  simulated  flight 
is  described  in  this  paper.  The  missile  is  a  fire- and- forget,  shoulder-launched,  anti-tank  weapon  that  lofts  to  an  altitude  of  approximately 
150  meters  and  then  homes  toward  the  target  using  proportional  guidance.  A  gyro  stabilized  seeker  is  processed  to  the  target  by  point¬ 
ing  commands.  These  pointing  commands  are  developed  from  an  imaging  sensor  by  a  new  tracking  algorithm  that  performs  well  in  a 
highly  cluttered  background. 

Both  the  tracking  algorithm  design  and  its  evaluation  in  missile  flights  were  accomplished  using  a  digital  computer  simulation 
called  HUGGER.  This  program  includes  a  6  degree-of-freedom  missile  simulation,  a  detailed  seeker  model,  a  three-dimensional  model 
of  the  target,  a  two-dimensional  background  model,  and  the  intelligent  tracking  algorithm. 


Sensor  images  of  the  target  as  seen  from  the  missile  are  formed  on 

a  64  x  128  pixel  I R-CCD  array.  The  algorithm  utilizes  three 

features  within  the  image  intensity,  spatial  frequency,  and  internal  gradients.  A  multithresholding  technique  is  also  described  which 

enhances  target  discrimination. 

SYMBOLS 

B 

flux  density 

V 

missile  velocity 

<  A  C  NY  ('NP 

aero  coefficients  for  normal  forces 
along  the  X,  Y,  Z  axes 

vs 

velocity  of  sound 

a 

angle  of  attack 

(  LD.  CMP-  (  MY 

aero  coefficients  for  moments  along 
the  X.  Y.  Z  axes 

P 

sideslip  angle 

*  LP<  CMQ  CNR 

aero  coefficients  for  damping  moments 

6 

vane  deflection 

along  the  X,  Y.  Z  axes 

Og 

pitch  gimbal  angle 

CC 

center  of  gravity  location 

P 

air  density 

d 

missile  reference  length 

♦g 

yaw  gimbal  angle 

F 

force 

u> 

angular  rate 

Fpit) 

missile  thrust 

SUBSCRIPTS 

H 

angular  momentum 

1 

inner  gimbal 

J 

moment  of  inertia 

o 

outer  gimbal 

M 

moment 

s 

spin  axes 

P.  0.  R 

missile  angular  body  rates 
about  the  X,  Y,  Z  axes 

X,  Y.  Z 

axes  of  a  right  hand  coordinate  system 

S 

t 

T 

ITsil 

ITmiI 


Laplace  operator 
missile  reference  area 
time 
torque 

inertiaMo-seeker  matrix  transformation 
inertial- to-mis&ile  matrix  transformation 


INTRODUCTION 

Tactical  missiles  of  today  have  definite  operational  limitations  because  seekers  are  apt  to  lose  track  with  targets  against  highly 
cluttered  backgrounds.  Such  scenarios  may  be  attacks  on  tanks  against  a  background  of  roads,  foliage,  rocks,  etc. ;  attacks  on  aircraft 
against  a  varied  cloud  background ;  or  attacks  from  above  on  aircraft  against  a  terrain  background. 

The  next  generation  of  tactical  missiles  may  use  imaging  trackers  because  of  the  large  amount  of  information  in  the  image  that 
can  be  utilized  by  an  intelligent  tracking  algorithm.  The  algorithm  is  used  to  separate  (or  segment)  the  target  from  a  cluttered  back¬ 
ground,  and  then  track  this  target.  With  the  advent  of  small,  solid  state  CCD  arrays  and  high  speed  microprocessors,  it  is  now  practical 
to  utilize  imaging  seekers  with  intelligent  tracking  algorithms.  Two  recent  developments  by  RCA  initiated  this  study.  These  are  the 
ATMAC  microprocessor  developed  by  the  Advanced  Technology  Laboratory  (Ref.  1),  and  the  Schottky- barrier  I R-CCD  array  developed 
by  the  David  Samoff  Laboratories  (Refs.  2 .  3.  4  and  5).  The  latter  is  a  64  x  128  element  staring  array  which  operates  in  the  3  to  5 
micrometer  wavelength  band  with  excellent  uniformity,  sensitivity,  and  dynamic  range.  Since  it  utilizes  silicon  technology,  its  potential 
production  economy  appears  very  attractive.  A  typical  image  produced  by  this  array  is  shown  in  Figure  1. 


FIGURE  I.  AIRCRAFT.  TANK  AND  JEEP  IMAGED  ON  A  SCHOTTKY-BARRIER  IR-CCD 


This  paper  describes  the  computer  simulation  work  that  verifies  successful  operation  of  a  missile  system  containing  the  IR-CCD 
array  and  tracking  algorithm.  The  missile  is  a  fire*and- forget,  shoulder-launched,  anti-tank  weapon  that  lofts  to  an  altitude  of  approxi¬ 
mately  150  meters  and  then  homes  toward  the  target  using  proportional  guidance.  A  gyro  stabilized  seeker  is  precessed  to  point  at  the 
target  by  signals  developed  from  the  new  tracking  algorithm.  These  signals  are  also  used  for  missile  guidance.  Both  the  tracking  algorithm 
design  and  its  evaluation  in  missile  flights  were  accomplished  using  a  digital  computer  simulation  called  HUGGER.  Program  MUGGER’S 
scenario  is  illustrated  in  Figure  2.  It  includes  a  6  degree-of-freedom  missile  simulation,  a  detailed  seeker  model,  a  three-dimensional 
model  of  the  target,  a  two-dimensional  background  model,  and  the  tracking  algorithm.  Actual  sensor  images  of  the  target  as  seen  from 
the  missile  are  displayed  to  assist  in  the  algorithm  development.  HUGGER  also  provides  each  corresponding  segmented  image  so  that 
the  algorithm's  discrimination  capability  can  be  evaluated. 

The  intelligent  tracking  algorithm  encloses  the  target  with  an  adaptive  gate  and  uses  multifeature  and  multithrcshold  techniques  to 
achieve  superior  image  segmentation.  A  rectangular  adaptive  gate  is  servoed  to  enclose  only  the  target  vicinity,  therehy  eliminating  most 
of  the  extraneous  background  clutter  within  the  field  of  view.  A  background  gate  is  located  just  around  the  perimeter  of  the  centroid 
gate.  There  are  three  features  extracted  from  the  image:  intensity,  spatial  frequency,  and  internal  gradients.  Each  of  these  features  is 
threxholded  using  the  multithreshold  technique  where  up  to  four  thresholds  are  automatically  employed,  allowing  target  pixels  to  be 
identified  if  they  are  above,  below,  or  in  between  background  value  bands.  Enhancement  is  accomplished  by  changing  the  intensity 
value  of  a  pixel  if  either  the  spatial  frequency  or  the  gradient  value  is  over  its  respective  threshold.  The  enhanced  intensity  feature  is  then 
finally  thresholded  to  provide  the  segmented  image.  Adaptive  gate  size,  seeker  pointing  commands,  as  well  as  missile  guidance  signals, 
are  all  derived  from  this  segmented  image. 

During  terminal  navigation,  when  the  target  fills  the  entire  field-of-view,  the  adaptive  gate  tracker  is  replaced  by  a  centrally  weighted 
correlation  tracker.  Correlation  is  performed  along  a  horizontal  strip  for  yaw  and  a  vertical  strip  for  pitch.  These  two  strips  form  a  cross 
at  the  center  of  the  field-of-view.  Because  of  the  high  rate  of  range  closure  and  the  high  line  of  sight  rates  during  terminal  flight,  correla¬ 
tion  must  be  done  on  a  frame-to-frame  basis.  Drift  due  to  the  range  closure  effect  is  minimized  by  centrally  weighting  each  correlation 
strip.  This  low  drift  algorithm  is  used  until  impact. 

The  simulations  showed  that  the  64  x  128  CCD  array,  with  the  intelligent  algorithm,  would  track  targets  in  high  clutter  and  could 
be  made  to  consistently  impact  the  upper  surface  of  a  tank  where  armor  is  at  a  minimum.  Program  HUGGER  was  an  excellent  tool 
for  evaluating  algorithm  modifications  during  development.  Algorithms  can  be  compared  over  the  same  trajectory,  with  the  same  target 
intensity  and  background  statistics.  It  would  be  impossible  to  do  this  otherwise,  even  with  actual  hardware.  HUGGER  also  allows  target 
tracking  with  realistic  l»ne  of  sight  rates  and  accelerations,  range  closure,  and  changing  aspect  angle. 


FIGURE  2  PROGRAM  HUGGER'S  SCENARIO 


PROGRAM  HUGGER 


Program  HUGGER  is  a  modularized  FORTRAN  program  consisting  of  the  subroutines  listed  in  Table  1.  A  flow  diagram  of  the  pro¬ 
gram  is  given  in  Figure  3,  and  a  functional  block  diagram  is  shown  in  Figure  4.  Output  data  is  provided  in  the  following  formats: 


1 .  Printed  data,  where  56  variables  are  printed. 

2.  Striplot  (Figure  5),  where  up  to  10  variables  are  plotted  against  time. 

3.  Segmented  image  plots  (Figure  6),  indicating  targe t/non target  pixels  as  determined  by  the  intelligent  algorithm. 

4.  Image  plots  (Figure  7),  where  images  formed  on  a  64  x  128  1R-CCD  array  are  plotted  using  a  gray  scale. 

Considerable  detail  is  modeled  in  HUGGER  so  that  many  parts  of  the  missile  system  can  be  studied  during  flight.  In  order  to  elimi¬ 
nate  excessive  execution  time,  the  following  options  are  provided: 


1 .  A  detailed  gyro  stabilized  seeker  with  gimbal  friction,  magnetic  torques  and  input  errors,  or  a  simplified  seeker  model 

2.  A  three-dimensional  target  model,  the  tracking  algorithm  and  image  forming,  or  a  simple  point  target. 

3.  An  optical  point  spread  function,  or  a  simple  one-ray-per- pixel  projection. 


4.  image  plots,  or  no  image  plots. 


5.  Steady  or  gusty  wind  or  both,  or  no  wind. 

6.  A  moving  or  a  static  target. 


TABLE  1 

PROGRAM  HUGGER  SUBROUTINES 


MAIN . 

DATA . 

MISSIL . 

QUATRN  . 
FUNCIV. . 
FUNC2V . . 
FUNC3V . . 
ATMOS.  . 
MAT33  .  .  . 
WINDYN.  . 
RANDOM 
FILTER 
GYRODY 
ACTUAT.  . 
TARGET.  .  .  . 

SEEK . 

TRACKR.  .  . 

PIMAGE  .... 


CALLS  SUBROUTINES  AND  OUTPUTS  DATA 
INPUTS  DATA 

SIX  DEGREE  OF  FREEDOM  MISSILE  SIMULATION 

QUATERNIAN  UPDATE  OF  I/B  MATRIX 

FUNCTION  OF  ONE  VARIABLE 

FUNCTION  OF  TWO  VARIABLES 

FUNCTION  OF  THREE  VARIABLES 

ATMOSPHERIC  MODEL 

MULTIPLIES  3X3  MATRICES 

WIND  GUST  DYNAMICS 

RANDOM  NUMBER  GENERATOR  FOR  GUSTS 

AUTOPILOT  A  ACTUATOR  PREFILTERS 

ROLL  RATE  GYRO  DYNAMICS 

ACTUATOR  DYNAMICS 

THREE  DIMENSIONAL  MODEL  OF  A  TANK 

TRACKING  SERVO  A  GYRODYNAMICS 

ADAPTIVE  GATE  A  CORRELATION  TRACKING 

ALGORITHMS 

PLOTS  THE  IMAGES  FROM  A  CCD  ARRAY 


MAIN 


FIGURE  3.  SIMPLIFIED  FLOW  DIAGRAM  OF 
PROGRAM  HUGGER 


IITIfifNIZE 


FIGURE  4  FUNCTIONAL  BLOCK  DIAGRAM  OF  PROGRAM  HUGGER 


FIGl’RF  5  STRIP  PLOT  FROM  PROGRAM  HUGGLR 
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MISSILE  MODEL 

The  missile  studied  in  this  paper  is  a  ground-to-ground  antitank  weapon  with  its  seeker  locked  on  before  launch  It  is  caused  to 
initially  loft  by  commanding  a  pitch  gimbal  angle  of  17  degrees  to  an  attitude  autopilot  whose  feedback  is  the  pitch  gimba!  angle  When 
the  pitch  line-of-sight  rate  signal  from  the  seeker  increases  to  6  degree,  the  control  law  is  switched  to  proportional  guidance  Propor¬ 
tional  guidance  is  always  used  for  yaw  control. 

The  six-degree-of-freedom  missile  model  is  described  by  the  block  diagram  of  Figure  4.  This  model  (Ref,  6)  contains  the  three  force 
equations  acting  on  the  missile  body: 

FX  =  -CA(a)Qs  +  FTO> 

fY  ~  Cny(0.  ®y>Qs 
FZ  *  -CNP<“'  ®P)Qs 

and  the  three  moment  equations. 

Mx  *  (Cld(M)6r  +  Clp(M)  DvP)  Qsd 

mY  -  !CMP(<*,5p)  +  CNp(a,5Y)(CG(t)-CGR)  +  CMq(M)DVQ1  Qsd 
-  ICmy  03.  ®Y>  +  Cny  iff,  6y)  (CG(t)  -  C'nr  (Ml  DyR)  OsD 

where: 

Q  = 

Qs  *  QS 

Qsd  -  Qsd 

DV  -  d/2V 

The  aerodynamic  coefficients  can  be  functions  of  one,  two  or  three  variables.  Linear  interpolation  is  employed  between  table  entries 
by  subroutines  FUNC1V,  FUNC2V,  and  FUNC3V. 

The  required  roll,  pitch  and  yaw  commands  (Sro  ®pc.  ®YC* tQ  On  actuators  are  obtained  by  processing  the  seeker  error  signals 
with  the  autopilot  transfer  functions-  The  individual  commands  to  the  fout  fin  actuators  are  obtained  by  using  the  following  relations 

®IC  *  *RC  *  ®YC  ®3C  *  -®RC  +  ®YC 

®2C  *  6 PC  ®4C  =  ®PC 

These  fin  commands,  when  acted  upon  by  the  actuator  dynamics,  result  in  four  actual  fin  deflections:  S|,  6;.  63,  t4  The  three 
equivalent  fin  deflections  required  for  obtaining  the  aero  forces  and  moments  are: 

«R  =<«|-«3>/2 

6p.  =  (6  o  +  ®4  )l- 

®Y  =  (5|  +  631/2 

The  coordinate  axis  system  assumed  for  the  above  equations  is  illustrated  in  Figure  8. 

A  quaternian  method  is  used  to  obtain  the  inertial-to-missile  body  coordinate  matrix  transformation.  .  as  well  as  the  inertial- 
to-seeker  transformation.  [T$|). 

TARGET  MODEL 

A  three-dimensional  model  of  a  tank  is  required  for  a  realistic  simulation  of  a  missile  system  with  an  imaging  seeker.  The  tank  mode) 
consists  of  seventeen  planes  or  facets,  each  ‘painted’  with  the  appropriate  radiance  value  to  create  a  tank-like  image.  The  resolution  on 
each  facet  is  0. 1 0  meters.  The  tank  sets  upon  a  two-dimensional  background  consisting  of  a  69  x  69  matrix  of  radiance  values  with  a 
resolution  of  2  meters.  Clutter  is  simulated  by  a  Gaussian  distribution  with  the  mean  and  standard  deviation  as  program  inputs.  It  is, 
however,  an  easy  matter  to  insert  a  road  under  the  tank  or  hot  objects  nearby.  An  optical  point  spread  function  provides  more  realistic 
images  of  the  target,  however,  this  feature  was  made  optional  because  it  increases  the  program  run  time  and  does  not  seem  to  appreciably 
affect  tracking  ability. 

The  target  is  modeled  by  incrementing  (pixel-by-pixel)  a  unit  vector,  Ug,  in  the  seeker  frame  until  the  entire  gate  area  within  the 
field-of-view  is  scanned.  A  transformation  to  the  inertial  frame  is  performed  after  each  pixel  increment  with  matrix  equation, 

U  \  *  ITsil  “1  Us-  Use  of  the  appropriate  trigometric  relations,  the  unit  pointing  vector  U  j,  and  the  vector  representing  the  distance 
between  the  target  and  the  missile  (see  Figure  4),  yields  the  location  of  where  a  ray  impinges  on  a  facet  The  resulting  two  coordinates 
on  the  facet  are  integerized  so  that  the  appropriate  radiance  value  can  be  obtained  from  a  two-dimensional  array  representing  that  facet. 

A  64  x  128  array  (called  CCD)  representing  the  image  is  then  loaded  with  these  radiance  values 
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Equation  (10)  can  be  further  simplified  by  use  of  Equations  (11)  and  assuming  that  wqx  *s  small, 

SToy  -  Jy“OY  +  HsuizCOS+g  (12) 

where: 

Jy  =  Joy  +  JjxSin^g  +  JjyCOS^g 

Equations  (9)  and  (12)  are  used  in  the  seeker  model  and  are  shown  in  the  block  diagram  of  Figure  1 1.  Notice  that  the  torque  summing 
points  are  conveniently  located  along  the  gimbal  axes. 

VA» 

AXIS 


FIGURE  10.  COORDINATE  SYSTEMS  FOR  THE  TWO 
DEGREE  OF  FREEDOM  GYRO 


FIGURE  1 1.  BLOCK  DIAGRAM  OF  THE  GYRO  DYNAMICS 


An  expression  for  the  magnetic  torques  (Ref.  8)  will  be  derived  with  torquer  coils  fixed  to  the  missile  body  and  a  magnet  fixed  to 
the  inner  gimbal.  Since  the  gimbal  rotation  order  used  in  this  analysis  is  pitch  (9g^  yaw  ('I'G)  followed  by  roll  ( aigt),  the  transformation 
matrix  from  a  body  to  seeker  frame  can  be  obtained. 

S_ 3  JT$g]  b 

where, 

«  unit  vector  in  the  body  frame 
s  =  unit  vector  in  the  seeker  frame 
(C  *G  C  0G) 

I 

ITsbI 


<S+G>  (-C*GS9c) 

(-Cwst  S+g^G  +  SwstS0Gl  (CwstC+c)  <Cws»S’I,gS<g  +  Su>stC0G) 
(JS^s'S+gCSc  +  CwstseG)  <-SuStC+G)  (-Sus'S+gSSg  +  CustC0G2j 


A  unit  vector  in  the  missile  body  frame  is: 
b  =  ITSB1  Tj 

If  a  magnet  is  aligned  along  the  seeker  Y-axis,  its  normalized  coordinates  in  the  missile  body  frame  are 


b  =  [TSBlT 


-CwstS+Gc9G  +  SwstSOc 
CustC+G 

Cu>stS+GS0G  +  Su)stC«G 

and  its  projection  along  the  missile  X-axis  is: 

b,  »  -  CwstS '•’G  C®G  +  SustS0G 


(131 


A  voltage  is  induced  in  the  coil  proportional  to  the  rate  of  flux  lines  cut  by  the  coil.  The  resulting  coil  current  will  produce  the  following 
induced  flux  density : 


B|  =  T|  b  , 


(14) 


where  T|  is  a  constant. 


Use  of  equations  ( 13)  and  (14)  yields: 


Bj  -  Tj  (SusHusS+gC^G  +  C9G®G>  +  C u>st(-C*Gc®G +G  +  S*cseG®G  +  “SSSG>1  05) 

The  flux  density  produced  by  the  control  signals  Hy  and  Ez  for  pitch  and  yaw,  respectively,  is: 

Bc  -  Tc  (Ey  Ccj^t  -  E^Scujjt)  (16) 

and  the  total  flux  density  vector  in  the  missile  frame  becomes: 

fi  MBC  +  Bj)  j.  (17) 

The  magnetic  torque  from  the  two  magnet  poles  is: 


Tm  =*  2tc  (B  X  b) 


Tm 


0 

-Bb7 

Bby_ 


0 

-(Bc  +  Bj)(Ca>stS*Gs#G  +  SwStC0G) 

(Bc  +  Bj)  (CwstC'J'Q) 


where  tc  is  a  constant. 

The  magnetic  torque  along  the  missile  Y  axis  (i.e.,  the  pitch  gimbal  axis)  is  obtained  using  Equations  ( 1 5),  ( 16)  and  (18): 
Tmy  =  2tc(Tc(EcCaiSt-EzSujSt)  +  TiSuSl(wSS'I'G^«G  +  C»C»G>  +  TjCwst  (-C+cCflo+G  + 
S+gS9g*G  +  <JSsflG>l  ‘  (C‘‘>StS'*'Gs®G  +  ScjgtC9G] 

Equation  (19)  can  be  simplified  by  the  following  identities  and  assuming  that  2 teg  is  beyond  the  bandwidth  of  the  tracker  loop: 


(18) 


(19) 


SlNcJ^t  COS  cost  *  l/2SIN2ust~0  SIN2wst  -  1/2  COS2mSt  ~  1/2  COS2<uSt  =  1/2  +  1/2  COS2iuSt  ~  1/2 
Tmy  =  tc(-TcEYS+GS«G+TcEzCflG-Ti“sS*G  +  Tj'i'G<C'J'GceGS'l'GS9G)  -  T,9g(C29g  +  S2*CS26G))  *'0) 


Equation  (20)  can  be  further  simplified  by  neglecting  terms  containing  0q  and  *G  since  they  ate  much  smaller  than  ws- 

Tmy  “  it  (TcEzCOSflG  -  TCEYSIN  +GS1N0G  -  TjusSIN  +G)  <2 1> 

Equation  (21)  provides  the  magnetic  torque  about  the  Y-gimbal  axis.  The  torque  along  the  Z  missile  axis  is  obtained  using  Equations  (15). 
( 16)  and  ( 18): 

tMZ  *  2tc(Tc(EYCu)st  -  E^SusD  +  TjSw$t(wsS+Gc8G  +  C9g®G>  +  TiC“S,(s*Gs#G®G* 


C*cC»G+G  +  «SS9G>I  [CustC+Gl 

Simplifying  as  before  yields: 

TMZ  =  tcfTcEYCOS*G  +  TjWsSlN«GCOS*G>  (22) 

Since  the  torque  about  the  Z-gimbal  axis  is: 
tGZ  =  TMZCX)S«G 

tGZ  -  tcCTcEYCOS+cCOSSG  +  TioJsSIN9GCOS9GCOS'l'G)  (23) 

Equations  (21)  and  (23)  are  put  in  the  following  forms  for  convenience: 

TgY  1  TzCOS9G  -  TYS!N+gSIN9g  -  ~  W*G  <24> 

TGZ  *  TyCOS*gCOS9g  *y-  SIN9GCOSflGCOS*G  (25) 


where. 

Tz  =  tcTcE 2,  torque  command  about  the  Y-axis 

TY  ■  tc^c^Y-  torque  command  about  the  X-axis 

H  -  ^  gyro  angular  momentum 

Tfr  -  autoerection  time  constant. 

These  are  the  magnetic  torque  equations  used  in  Program  HUGGER. 

Gimbal  angles  are  obtained  from  the  inert  iaTto-missite  and  the  inertial-toseeker  matrix  transformations,  ITmjI  and  (T$|l  These 
two  matrices  are  obtained  using  a  quatemian  method.  The  seekeMo-missile  transformation.  IT^sl  becomes: 

(TmsI  *  (TMll  ITs|IT 


9- 


Thc  three  components  in  the  missile  frame  of  a  unit  vectot  which  hes  along  the  seeker  X-axis  are: 


TXI 

"  r 

Tx: 

=  Itmi*  itS[I 

0 

TXJ 

0 

from  which  the  gimbal  angles  are  obtained: 

»c,  =  tan-'  <-tX3/tXI) 

+G  *  SIN-*  (Tx3i 

An  electrical  nutation  damping  loop  was  effective,  easily  adjusted,  and  economical  to  implement.  A  gimbal  angle  signal  is  merely  passed 
through  two  tillers  and  then  fed  back  and  summed  with  the  voltage  precession  commands,  as  illustrated  in  Figure  1 2.  The  filters  consist 
of  a  differentiator  followed  by  a  bandpass  filter.  Only  a  single  feedback  loop,  in  either  pitch  or  yaw.  is  necessary.  Also,  either  simsoidal 
or  square  wave  commutating  signals  can  be  used. 


FILTER 

FIGURE  12.  BLOCK  DIAGRAM  OF  NUTATION  DAMPING  LOOP 
INTELLIGENT  TRACKING  ALGORITHM 

A  major  purpose  of  this  paper  is  to  emphasize  the  advantages  of  using  an  intelligent  tracking  algorithm  in  a  homing  missile.  The 
significant  features  of  the  algorithm  will  therefore  be  described.  An  overall  block  diagram  showing  the  sequence  of  operations  is  given 
in  Figure  13. 


FIGURE  1 3.  BLOCK  DIAGRAM  OF  TRACKING  ALGORITHM 

A  prime  consideration  during  development  of  this  algorithm  was  its  implementation  in  real  time  with  a  minimum  of  electronics 
The  algorithm  was  therefore  made  one-dimensional  to  minimize  execution  time  and  memory  requirements. 

An  adaptive  gate  is  used  by  the  tracker  to  enclose  only  the  target  area,  thereby  eliminating  the  processing  of  extraneous  clutter 
some  distance  from  the  target.  This  gate  adaptively  changes  in  size  to  enclose  the  target,  while  the  target  is  kept  centered  in  the  field- 
of- view  by  the  gimbal  servos.  The  gate  arrangement  is  shown  in  Figure  14.  Four  edge  gates  are  located  along  each  side  of  a  rectangular 
shaped  centroid  gate.  A  narrow  background  gate  is  placed  around  the  pe;  meter  of  the  centroid  gate. 
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Simplified  one-dimensional  operation  of  the  tracker  is  illustrated  in  Figure  15.  If  the  target  grows  in  size,  the  edge  gates  expand, 
thereby  increasing  the  si2e  of  the  centroid  gate.  The  signal  to  spread  or  contract  the  edge  gates  is  obtained  by  an  area  balance  tech¬ 
nique  (target/non-target)  within  each  pair  of  edge  gates  (right/lcft,  top/bottom).  The  signals  to  move  the  gimbals  are  developed 
within  the  centroid  gate.  Again,  an  area  balance  technique  (target/non-target)  is  used  within  each  half  of  the  centroid  gate  (right/left. 
top/bottom).  The  centroid  gate  continually  adapts  to  enclose  only  the  target  region  and  thereby  eliminates  most  of  the  clutter  within 
Ihe  FOV. 


BACKGROUND 
GATE^ 


TOP  EDGE 
GATI 


FIGURE  14.  GATE  ARRANGEMENT  FOR  THE  ADAPTIVE  GATE  TRACKER 
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FIGURE  15.  OPERATION  OF  THE  ADAPTIVE  GATE  TRACKER 

The  tracking  servo  must  be  designed  (Ref.  9)  to  complement  the  tracking  algorithm.  A  type-one  servo  was  not  used  because  it 
develops  ex cessive  efTor  signals,  particularly  during  terminal  flight  when  line-of-sight  rates  and  accelerations  are  high.  An  offset  target 
results  in  a  larger  gate  which  encloses  more  cluttered  background  and  degrades  tracking.  A  type-two  tracking  servo,  shown  by  the 
simplified  block  diagram  of  Figure  16,  eliminates  this  problem. 


FIGURE  16.  SIMPLIFIED  TRACKING  SERVO 


1 


Y 


> 


Three  features  of  the  image  -  intensity,  spatial  frequency,  and  gradient  -  are  determined  for  every  pixel  within  the  gate  areas. 
The  three  feature  values  for  each  pixel  of  a  line  are  all  determined  during  the  scan  of  that  line.  Figure  17  shows  how  values  are 
assigned  to  a  line  of  pixels.  It  also  illustrates  the  uncoirelated  nature  of  the  three  features. 


VALUE 

125.3  -  25.3P,  P»-  4 
30.5  •  1.S4P,  P  •  4 
P  PIXAL  COUNTS 


VALUE  ;  MA  MUM  OF 
IV(n)  •  V(n  ..  OR 
IV(n)  -  V(n  1)1 


FIGURE  17.  ASSIGNMENT  OF  FEATURE  VALUES 

The  spatial  frequency  and  gradient  features  are  first  thresholded.  The  intensity  feature  is  then  increased  with  a  multiplying  factor 
each  time  the  spatial  frequency  or  gradient  is  above  threshold.  Finally,  the  enhanced  feature  is  thresholded  for  each  pixel,  yielding 
the  segmented  t target /non- target)  image. 

A  tracker  with  conventional  thresholding  suffers  from  a  disadvantage,  as  illustrated  by  Figure  IK. 
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a.  THIS  TARGET  CAW  B£  THRESHOLDED 
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FIGURE  18.  CONVENTIONAL  THRESHOLDING 


A  Htack  target  against  a  white  and  gray  background  is  shown  in  Figure  18-a.  In  this  case,  the  average  background  level  is  between 
gray  and  white,  and  a  threshold  level  can  easily  be  established  somewhat  above  the  background.  The  scene  in  Figure  J&b.  with  a  gray 
target  against  a  white  and  black  background,  cannot  be  thresholded  even  though  the  target  is  easily  discernible  by  eye.  In  this  case,  the 
average  background  level  is  gray  (between  black  and  white),  as  is  the  target.  Multithresholding  eliminates  this  problem. 

The  mu Jtt thresholding  technique  requires  the  use  ol  the  background  and  centroid  gate  statistics  for  each  feature  In  general  tnesc 
statistics  are  scene  dependent.  non-Gaussian.  and  skewed.  Figure  19  shows  a  plot  of  intensity  values  for  each  pixel  along  a  scan  line  and 
illustrates  how  multithresholding  is  accomplished.  Because  of  the  irregular  statistics,  the  following  computational  steps  are  required. 
First,  the  background  and  centroid  window  averages  (Wg.  W(  )  are  calculated.  Then,  two  local  averages  arc  obtained  for  each  window, 
one  for  pixel  values  above,  and  one  for  pixel  values  below  each  window  average  These  are  shown  in  Figure  19  as  B|-(.  for  the  back¬ 
ground  gate  and  r^,  L  ^  for  the  centroid  gate  The  standard  deviation  is  next  calculated  for  pixel  values  above  and  below  each  window' 
average  These  are  shown  in  Figure  1°  asO(;n«  °CL  ^OT  Me  centroid  gate.  The  six  signal  levels.  L ,  through  Lh.  are  obtained  by  using 
the  local  averages  and  the  standard  deviations.  Four  threshold  levels.  T  j.  Tv  T and  T4  are  calculated  from 


T I  «  i-: 


A. 


I3  -  A.  T  t  -  L4  +  A  and  T4  “  L  5  +  A. 
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(FOR  THE  INTENSITY  FEATURE) 


where 


A  =  GAIN  |MAX(D).-D2.  D3)). 


The  value  of  GAIN  is  determined  by  servos  (one  for  each  feature),  which  forces  an  acceptable,  five  percent  of  background  pixels 
to  be  misclassified  as  target  pixels.  A  flow  diagram  for  thresholding  the  intensity  feature  is  given  in  Figure  20.  Thresholding  for  spatial 
frequency  and  gradient  is  identical.  It  should  be  noted  that  the  current  video  intensity  signal  (BAL)  is  compared  to  the  four  threshold 
signals  (Tj.T2.T3,  T4)  which  were  determined  from  the  previous  frame.  If  a  particular  pixel  is  classified  as  target,  then  INT  =  1 ;  if 
non-target,  then  INT  *  0.  A  significant  improvement  in  segmentation  was  obtained  using  this  multithresholding  technique. 


FIGURE  20.  THRESHOLDING  FOR  THE  INTENSITY  FEATURE 


Gate  size  and  servo  error  signals  are  determined  from  the  segmented  image,  as  indicated  in  the  block  diagram  of  Figure  21.  Most 
calculations  are  performed  during  the  line  scan.  End-of- frame  computations  are  thereby  minimized,  so  that  the  total  processing  time  is 
small.  The  weighting  factors  W  \  and  W2  have  values  of  +2  and  -1,  respectively.  The  weighting  factor  Wf  is  given  a  value  equal  to  the 
distance  (in  pixels)  from  the  center  of  the  field  of  view,  and  the  factor  K  is  used  for  converting  pixels  to  radians. 


The  signals  which  determine  the  width  and  height  of  the  centroid  gate  are  processed  with  digital  filters.  It  is  desirable  to  have  low 
bandwidth,  type-2  seivos  controlling  the  gate  size.  The  low  bandwidth  prevents  gate  jitter,  and  the  type- 2  servo  allows  the  gate  to  expand 
at  a  high  rate  during  the  terminal  portion  of  the  missile  trajectory.  It  was  therefore  desired  to  have  a  gate  servo  whose  open  loop  Laplace 
transfer  function  is: 


G(s)  = 


.4(S/.4+  1) 
S2 


(26) 


The  equivalent  ^transform  (Ref.  10)  can  be  obtained  by  using  a  bilinear  transformation: 


S 


_2_  1  -Z-l 
T  l+Z-l 


Substitution  of  Equation  (27)  into  (26)  yields: 


G<Z)  =  008 


I  +  .00665Z-|-.99335Z-2 
I-2Z-' tZ-2 


(27) 


This  difference  equation  is  shown  implemented  in  the  block  diagram  of  Figure  22. 
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FIGURE  21.  GATE  SIZE  AND  SERVO  ERROR  DETERMINATION 


FIGURE  22.  DIGITAL  FILTER  FOR  WINDOW  SIZE 

During  terminal  guidance,  the  image  of  the  tank  becomes  large  and  eventually  fills  the  entire  field-of-view.  When  this  happens,  the 
adaptive  gate  algorithm  will  not  work  because  the  gates  cannot  function.  A  simple  correlation  tracker  is  therefore  switched  into  use  when 
the  centroid  gate  exceeds  approximately  80%  of  the  field-of-view.  The  vertical  and  horizontal  correlation  strips  (sec  Figure  23)  are  used 
to  generate  the  pitch  and  yaw  servo  error  signals.  These  strips  are  four  pixels  wide,  to  reduce  sensitivity  to  missile  roll.  Each  set  of  four 
pixels  is  averaged  to  obtain  a  single  signature  along  the  strip.  This  results  in  a  horizontal  signature  1  x  40  pixels  and  a  vertical  signature 
1  x  72  pixels.  A  flow  diagram  for  the  correlation  tracker  is  shown  in  Figure  24.  A  slice  is  taken  through  both  signatures  at  a  level  of  the 
last  signature's  average  value.  The  two  signatures  are  then  digitized.  Le.,  given  a  value  of  +  1  or-l.  depending  on  whether  its  signal  is 
above  or  below  the  slice.  Because  of  the  large  amount  of  target  expansion  during  terminal  guidance,  a  frame- to- frame  correlation  is 
required.  The  last  digitized  signature  therefore  becomes  the  current  digitized  reference  signature.  Correlation  is  done  by  shifting  the 
live  signature  four  pixels  to  the  left  and  four  pixels  to  the  right  with  respect  to  the  reference  signature.  This  procedure  is  illustrated  in 
Figure  25.  During  each  shift,  each  of  the  aligned  pixels  is  compared.  If  the  aligned  pixel  of  the  live  signature  is  the  same  as  that  of  the 
reference  signature,  a  value  of  WGHT  is  accumulated.  If  they  are  different,  a  value  of  -WGHT  is  accumulated.  The  value  of  WGHT  in¬ 
creases  linearly  as  the  center  of  the  field-of-view  is  approached.  It  ranges  from  1.  to  i4. 1  for  the  horizontal  correlation  and  from  I.  to 
±7.3  for  the  vertical  correlator.  This  center  weighted  correlation  significantly  reduced  the  drift  due  to  range  closure. 

In  order  to  Find  the  pitch  and  yaw  error  signals,  the  shift  with  the  greatest  correlation  value  is  determined.  Shift  number  0  indicates 
a  zero  error  condition  (Figure  25).  The  shift  number  (in  pixels)  is  converted  to  the  offset  eTTor  (from  shift  number  0  in  radians.  This 
offset  error  is  accumulated  for  implementation  of  a  type-one  servo.  If  a  no-correlation  condition  occurs,  the  last  offset  error  is  used.  A 
sequence  of  images  during  the  terminal  trajectory  is  given  in  Figure  7.  Notice  that  the  correlation  strips  stay  locked  on  to  (he  same  point 
on  the  tank  in  spite  of  a  large  image  expansion  rate  and  high  line  of  sight  rates. 

CONCLUSIONS 

Recent  military  events  have  vividly  shown  that  precision  guided  missiles  are  so  effective  they  have  changed  concepts  of  modem  war¬ 
fare.  With  the  advent  of  small,  high  speed  microprocessors  and  solid  state  staring  arrays,  this  trend  will  continue.  Imaging  seekers  which 
utilize  considerably  more  information  concerning  the  target  area  are  now  possible.  The  recently-developed  Schottky- barrier  IR-CCD 
sensor  array  has  the  potential  for  being  economic  Jly  produced  since  it  is  fabricated  using  conventional  silicon  technology.  Intelligent 
tracking  algorithms  can  be  implemented  economically  with  software  using  presently  available  digital  processors. 

Development  of  intelligent  algorithms  can  be  accomplished  efficiently  by  using  computer  simulations  of  the  entire  missile- target 
system.  All  the  variables  of  the  algorithm  and  missile  are  observable,  and  both  the  target  intensity  and  the  background  statistics  are 
controllable. 
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FIGURE  23.  CORRELATION  TRACKER  FOR  TERMINAL 
GUIDANCE 


FIGURE  24.  FLOW  DIAGRAM  FOR  CORRELATION 
TRACKER 


FIGURE  25.  OPERATION  OF  CORRELATION  TRACKER 
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SYSTEMES  ANEMOBAROMETRIQUES  POUR  AVIONS 


DE  LA  PROCHAINE  GENERATION 
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RESUME 

Le  but  de  cet  expose  est  de  presenter  les  grandes  lignes  et  les  r£sultats  signifi- 
catifs  d'une  etude  g^n^rale  concernant  les  moyens  anemobarometr iques  des  avions  de 
la  prochaine  generation,  etude  soutenue  par  le  Service  Technique  des  Telecommuni¬ 
cations  et  Equipements  (STTE)  Frangais. 

On  examine  1* evolution  des  equipements  dans  le  passe  et  on  presente  les  nouvelles 
tendances.  Deux  architectures  typiques  sont  presentees,  representatives  de  deux 
conceptions  differentes  (Systfcme  Integre  ou  Specifique) .  Une  enqu£te  menee  en  1980 
aupre.s  de  nombreux  organismes  ,  tant  en  France  gu'aux  Etats-Unis  ,  a  montre  que  la 
deuxifcme  solution  avait  de  plus  nombreux  partisans. 


INTRODUCTION 

L’ importance  des  systkmes  anemobarometriques  s' est  considerablement  accrue  au  cours 
du  temps.  De  simples  indicateurs  pneumatiques  ,  ils  sont  devenus  des  elements  impor- 
tants  de  1‘equipement  des  avions. 

L'apparition  de  systkmes  d'armes  de  plus  en  plus  sophistiques  et  des  commandes  de 
vol  eiectriques  est  pour  une  grande  part  responsables  de  cet  etat  de  fait. 

Le  Service  Technique  de  1 ' Aeronautique  (STA6)  puis  le  Service  Technique  des  Tele¬ 
communications  et  des  Equipements  Aeronautiques  (STTE)  ont  soutenu  une  etude  gene- 
rale  des  moyens  anemobarometriques  pour  avions  de  la  prochaine  generation,  etude 
menee  par  notre  socidte.  Cette  etude  comportait  plusieurs  volets  : 

-  recensement  des  besoins  en  fonctions  anemobarometriques , 

-  analyse  des  methodes  et  moyens  envtsaqeables  pour  r^pondre  b  ces  besoins  , 

-  diverses  etudes  ponctuelles  pour  etayer  les  choix  precedemment  fa  its. 

La  synthase  de  ce  travail  a  permis  d'approcher  les  specifications  preiiminaires  des 
principaux  constituants  des  architectures  de  systfemes  anemobarometriques  possibles 
dans  l’avenir  ainsi  que  leur  relative  complexite.  Une  enqudte  aupr&s  des  construc- 
teurs  d' avions  et  des  Services  Officiels  en  France  et  aux  Etats-Unis  a  permis  d' eta¬ 
yer  cette  demarche. 


EVOLUTION  DU  BESQIN 

L* apparition  de  systfcmes  d'armes  de  plus  en  plus  sophistiques  ainsi  que  des  comman¬ 
des  de  vol  eiectriques  sont  les  raisons  majeures  de  1' existence  de  deux  specifica¬ 
tions  concernant  les  systfcmes  anemobarometriques  : 

-  Specification  de  sdcurite  :  la  perte  de  certaines  informations  de  ce  type 
imposerait  au  mieux  l'arrfit  de  la  mission.  Au  pire  ,  elle  peut  dtre  catastrophique 
pour  1* avion  et  son  equipage. 
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-  Specification  de  rapidite  :  1 ' accroissement  des  bandes  passantes  des  com¬ 
mandes  de  gouverne  et  de  la  manoeuvrability  en  decoulant  ont  des  repercussions  sur 
les  systemes  anemobarometriques  qui  devront  avoir  de  meilleures  bandes  passantes. 

L* introduction  de  calculateurs  de  plus  en  plus  petita,  integres  et  efficaces  a 
permis  (reference  1)  : 

-  une  miniaturisation  de  i'avionique  et  correiativement  une  diminution  impor- 
tante  du  poids  ,  du  volume  et  de  la  consommation.  Par  exemple  :  38  kg,  200  VA  pour 
la  centrale  anemometrique  du  FI 05,  8  kg  et  90  VA  pour  celle  du  FI  5  , 

-  une  complexity  croissante  caract£ris&e  par  1  *  augmentation  du  nombre  d' en¬ 
trees/sorties.  Par  exemple  63  E/S  pour  la  centrale  anemometrique  du  FI  5,  198  pour 
celle  du  F18, 

-  une  augmentation  importante  de  la  fiabilite  de  ces  syst^mes.  Le  taux  de 
couverture  des  tests  integres  atteint  en  effet  maintenant  95  &  98  %. 

Les  resultats  d'une  enqu£te  effectuee  en  France  et  aux  Etats-Unis  aupr£s  de 
Services  Officiels  et  d'avionneurs  montrent  que  ces  tendances  vont  se  maintenir 
dans  I’avenir. 

-  La  technologie  du  contrfile  actif  ("CAG"  ou  "CCV'*  et  1 ' utilisation  de  commandes 
de  forces  directes  imposent  l'emploi  de  commandes  de  vol  eiectriques  (reference  2 
et  3) .  11  est  done  probable  que  les  exigences  de  fiabilite  et  de  security  vont 
devenir  de  plus  en  plus  critiques. 

L' incidence  et  le  derapage  seront  sQrement  Jes  informations  primordiales  pour  ~e  genre 
de  systeme,  puisqu ' utilisees  systematiquement  dans  les  boucles  primaires  des  commandes 
de  vol.  Le  nombre  de  Mach  et  la  pression  cinetique  resteront  des  parametres  critiques. 

Enfin,  l'utilisation  intensive  de  syst^mes  num6riques  peut  conduire  h  imposer  des 
sorties  numeriques  ou  facilement  numerisables  pour  les  capteurs  et  sondes  (sorties 
frequences)  et  m£me  &  devenir  un  critere  de  choix  pour  un  nouveau  principe  physique. 

-  L’ accroissement  des  performances  et  de  la  manoeuvrability  des  avions  pourra  conduire 
h  specifier  s 

-  Un  accroissement  de  bande  passante  pour  : 

-  1* incidence  et  le  derapage,  principalement  pour  des  raisons  de 
security  , 

-  la  temperature  d'arr@t,  pour  amyiiorer  &  la  fois  les  performances  de 
navigation  dans  le  plan  vertical  et  celles  des  contrdles  des  moteurs 

et  des  entr4es  d'air.  La  precision  sur  ce  paramfctre  devra,  par  ailleurs, 
£tre  augmentee. 

-  Un  eiarglssemen  .  de  la  gamme  de  mesure  de  1' incidence  et  du  derapage. 

-  Une  reduction  h  a  fois  du  nombre  et  de  la  taille  des  protuberances  situees 
h  l'exterieur  de  la  peau  de  1* avion  et  susceptibles  de  perturber  l*6coulement  aero- 
dynamique  autour  de  1' avion. 

-  Voler  en  transsonique ,  &  basse  altitude  et  dans  le  contexte  de  guerre  nucieaire 
imposer a  : 

-  L' utilisation  d'un  detecteur  de  rafale  (si  un  systfeme  en  "boucle  ouverte" 
est  retenu) . 

-  Le  durcissement  aux  radiations  nucieaires  et  aux  champs  electromagnet iques 
associes  aux  explosions  ou  h  la  foudre. 

-  Enfin,  les  probl^mes  de  coflt  de  cycle  de  vie  sont  de  plus  en  plus  aigus  pour  les 
sy st ernes  d’armes.  Cette  exigence  peut  fttre  prise  en  compte  par  : 

-  reduction  de  la  masse  et  du  volume  pour  tous  les  equipemenffe,  calculateurs, 
sondes  et  capteurs  , 

-  reduction  des  coQts  d' acquisition, 

-  amelioration  de  la  fiabilite, 

-  amelioration  de  la  maintenabilite  des  composants  et  du  systeme  lui-m£me,  et 
cela  par  une  prise  en  compte  de  ces  contraintes  dfes  le  debut  du  pro jet. 
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EVOLUTION  DES  ARCHITECTURES 

Le  but  de  cette  demarche  eta  it  uniquement  d'obtenir  un  certain  nombre  d' indications 
sur  la  complexity  relative  de  diffirentes  solutions  d'organisation  des  composants 
susceptibles  d'entrer  dans  la  composition  d*un  systfcme  an6mobarom4trique.  II  ne  se 
veut  pas  exhaustif  ,  1 'organisation  etant  trfcs  li6e  £  la  configuration  finale  de 
1' avion  :  il  n'existe  probablement  pas  d 1  architecture  disponible  a  priori  pour  tout 
type  d' avion  de  combat. 

On  a  done  essay4  de  prendre  en  compte  les  besoins  recenses  precedemment  dans  deux 
architectures  typiques.  Ces  architectures  sont  elles-m£mes  representatives  de  deux 
concepts  g4neraux  concernant  les  syst^mes  specifiques  et  integres  (references  4-5-6). 

Un  certain  nombre  d* hypotheses  communes  aux  deux  architectures  ont  ete  faites  : 

-  Redondance  d'ordre  trois  pour  les  informations  &  destination  des  commandes 
de  vol  (y  compris  1* incidence  et  le  derapage) . 

-  Source  pneumatique  pour  1' incidence  et  le  derapage  (sondes  multiorifices 

ou  prises  de  pression  statique  laterales) .  Cette  solution  a  I'avantage  de  minimiser 
le  nombre  de  protuberances  sur  le  fuselage  de  1* avion. 

-  Redondance  d'ordre  deux  pour  les  informations  h  destination  du  systfeme 
d'arme,  des  moteurs  et  des  entrees  d'air.  Pour  ces  deux  derniers  types  de  para- 
metres  ,  fourniture  sous  forme  numerique  (liaison  point  &  point  ARINC  429  par 
exemple) . 


SYSTEME  INTEGRE 

Ce  syst^me  (Figure  1)  est  tr£s  volsin  de  celui  decrit  dans  les  references  (7  et  0). 

L’id4e  directrice  consiste  h  distribuer  dans  1' avion  un  certain  nombre  de  capteurs 
effectuant  des  mesures  primaires.  Une  telle  organisation  doit  se  comprendre  dans  un 
cadre  plus  large,  prenant  en  compte  d'autr<.3  paramfetres,  par  exemple  de  nature  iner- 
tielle.  On  ne  s'interesse  ici  qu’aux  param^tres  de  nature  anemobarometrique,  e'est- 
e-dire  pressions  et  temperatures. 

Ces  informations  de  pression  et  temperature  sont  pre-trait4es  localement,  h  proxi- 
mite  immediate  des  capteurs. 

L* acquisition  ,  1 ' echantillonnage  et  les  corrections  d'effets  locaux  (temperature) 
une  fois  effectues,  les  valeurs  numeriques  des  paramfctres  sont  emises  sur  un  bus 
numerique  multiplexe  tri-redondant  (61ectrique  ou  optique) .  La  redondance  d'ordre 
trois  est  necessaire  pour  les  commandes  de  vol  eiectriques. 

Le  calcul  des  paramfetres  dits  eiabores  ,  tels  que  le  nombre  de  Mach,  la  vitesse  air, 
les  corrections  globales  (telles  que  les  corrections  d'antennes),  les  tests  et  les 
comparaisons  &  des  fins  de  verifications  de  coherences  sont  tous  effectues  en  dehors 
du  sous-systAme  nroprement  dit.  On  suppose  qu'il  existe  un  systfcrae  exterieur  capable 
d'effectuer  ces  »  je,  suffisamment  robuste  et  fiable  pour  fournir  &  tous  les  sous- 
systfcmes  utilisateurs  avec  les  performances  requises  1 ' information  qui  leur  est 
necessaire.  Ce  systfeme  gfcre  par  ailleurs  les  bus  numeriques. 

Les  composants  de  cette  architecture  sont  : 

-  Une  sonde  pneumatique  multifonction,  situee  au  nez  de  l'appareil.  Elle  four- 
nit  des  informations  de  pression  concernant  la  presslcn  d' arret,  la  pression  stati¬ 
que,  les  angles  d' incidence  et  de  derapage. 

-  Deux  sondes  multifonction  "en  L"  situees  sur  les  cOtes  du  fuselage.  Elies 
fournissent  des  informations  de  pression  concernant  la  pression  generatrice,  la 
pression  statique  et  1' incidence. 

-  Deux  sondes  de  temperature,  bi-eiement  et  ddgivrees. 

-  Deux  paires  de  prises  de  pression  statique  feurnissant  une  information  de 
derapage. 

-  Trois  modules  eiectroniques  identiques  comprenant  : 

-  un  capteur  de  pression  absolue, 

-  trois  capteurs  de  pression  dif f erent ielle 

(ces  quatre  capteurs  .’.ont  de  bonne  precision  relative  :  quelques  cer- 
ti ernes  de  pour  cent) . 
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-  qua t re  circuits  de  mesure  des  informations  dfelivrfees  par  ces  capteurs 
de  pression  {mesure  de  frequence) , 

-  un  microcalculateur  (de  classe  8  bits)  qui  calcule  les  corrections 
locales  de  temperature ,  felabore  les  informations  de  pression  brute, 
assure  une  surveillance  eifementaire  des  capteurs  et  gfere  les  entries/ 
sorties, 

-  un  interface  felectronique  simple  pour  la  log^que  et  de  redondance 
d'ordre  trois  pour  les  circuits  d' emission  et  de  reception, 

-  pour  deux  d'entre  eux,  deux  circuits  de  mesure  de  resistances  (tempe¬ 
rature  d' arrfet) . 

Rien  d'autre  n*est  necessaire,  les  bus  etant  geres  par  ailleurs  dans  le  systeme  de 
calculateurs  centraux. 

One  telle  architecture  presente  les  avantages  suivants  : 

-  Extensibilite  :  le  nombre  de  capteurs  dialoguant  sur  le  bus  peut  £tre  modi- 
fie  assez  aisement  au  cours  de  1* evolution  du  projet* 

-  Standardisation  possible  au  niveau  materiel,  ce  qui  peut  amener  des  diminu¬ 
tions  importantes  du  coflt  de  cycle  de  vie. 

-  Faible  vulnerabilite  :  le  sous-systfeme  proprement  dit  peut  fetre  disperse 
done  peu  vulnerable  aux  impacts  de  projectiles.  La  vulnerabilite  du  systeme  cou¬ 
plet  depend  de  l'agencement  du  calculateur  central. 

-  Minimisation  du  nombre  d' unites  de  calcul. 

Elle  presente  aussi  les  inconvenients  suivants  : 

-  Validation  du  logiciel  :  h  chaque  etape  du  projet  et  h  chaque  modification, 
la  validation  du  logiciel  principal  est  relativement  difficile,  de  mfeme  que  les 
demonstrations  de  securite. 

-  Gestion  du  logiciel  :  elle  est  lourde  dans  les  unites  de  calcul  centralizes 
du  fait  des  interactions  multiples. 

-  Fralcheur  de  1 ' information  :  elle  n'est  pas  accessible  aisement. 

-  Coordination  difficile  :  la  coordination  du  programme  entre  les  Services 
Officiels  , les  avionneurs  et  les  equipes  de  pro jet  peut  fetre  problfematique  en  cas 
d'extension  fe  des  mesures  de  nature  inertielle. 


SYSTEME  SPECIFIQUE 


Ce  systeme, du  point  de  vue  de  sa  philosophie  de  conception,  se  rapproche  des  systfemes 
actuels  Figure  2).  Neanmoins  ,  l1 ensemble  des  besoins  fenumferfes  plus  haut  a  fet<5  pris 
en  compte,  en  particulier  les  probifemes  de  sfecuritfe  et  1 ' utilisation  intensive  de 
techniques  digitales. 

L'idfee  principale  est  d'effectuer  1* ensemble  des  calculs  de  paramfetres  anfemobaro- 
mfetriques  dans  un  ou  deux  boltiers  spfecifiques.  Ces  boltiers  possfedent  feventuel- 
lement  eux-mfemes  des  capteurs  ou  des  circuits  de  mesure  de  capteurs  et  regoivent 
des  informations  d'autres  boltiers.  Un  certain  nombre  de  verifications  de  validity 
et  de  tests  de  coherence  sont  effectufes  dans  le  sous-systfeme  qui  fournit  done  les 
paramfetres  anfemobaromfetriques  requis  et  1 '  information  de  validitfe  associfee. 

Toutes  les  corrections  sont  faites  dans  le  sous-systfeme  : 

-  Corrections  locales  (temperature)  prfes  des  capteurs, 

-  Corrections  d'ordre  global  (incidence,  dferapage,  nombre  de  Mach,  corrections 
dites  d'antenne). 


Le  sous-systfeme  eiabore  done  toutes  les  informations  nfecessaires  aux  utilisateurs  et 
les  leur  fournit  sous  la  forme  la  mieux  adaptfee  (bus  numferique  multiplex^  felectrique 
ou  optique,  bus  unidirectionnel  type  ARINC  429  ou  autre) .  La  gestion  des  bus  se  fait 
tou jours  en  dehors  du  sous-systfeme  lui-mfeme. 


Les  composants  de  1 'architecture  sont  : 

-  Une  sonde  pneumatique  multifonction  situ^e  au  nez  de  1* apparel 1.  Elle  four- 
nit  des  informations  de  pression  concernant  la  pression  d'arrdt,  la  pression  stati¬ 
que,  les  angles  d' incidence  et  de  d4rapage. 

-  Deux  sondes  multifonction  "en  L"  dispos^es  sur  les  c6t4s  du  fuselage.  Elies 
fournissent  des  informations  de  pression  concernant  la  pression  d'arrftt,  la  pression 
statique  et  1' incidence. 

-  Deux  sondes  de  temperature  bi-eiement  et  d£givr€es. 

-  Deux  pa  ires  de  prises  de  pression  statique. 

-  Deux  modules  eiectroniques  identiques  comprenant  : 

-  un  capteur  de  pression  absolue, 

-  trois  capteurs  de  pression  dif ferentielle, 

-  quatre  circuits  de  mesure  des  informations  deiivrees  par  ces  capteurs 
(mesures  de  frequences), 

-  un  micrccalculateur  (de  classe  8  bits)  qui  calcule  les  corrections 
locales  de  temperature,  eiabore  les  informations  de  pression  brute, 
assure  une  surveillance  eiementaire  des  capteurs,  gfcre  les  entrdes/ 
sorties  et  effectue  des  comparaisons  grossidres  avec  les  autres  sour¬ 
ces  d' information  anemobarometrique  , 

-  un  interface  eiectronique  simple  pour  la  logique  et  de  redondance 
d'ordre  trois  pour  les  circuits  d1 emission  et  de  reception. 

-  Un  module  eiectronique  comprenant  : 

-  un  capteur  de  pression  absolue, 

-  trois  capteurs  de  pression  dif f4rentielle , 

-  quatre  circuits  d' acquisition  pour  ces  capteurs, 

-  quatre  circuits  de  mesure  de  resistances  (temperature  d' arret)  , 

-  deux  microprocesseurs  de  taille  moyenne  (de  classe  16  bits)  avec  appro- 
ximativement  10  kilomots  de  memoire.  I Is  calculent  les  parametres  41a- 
bores  (nombre  de  Mach,  vitesse  air,...) ,  toutes  les  corrections  neces- 
saires  (y  compris  les  corrections  d'antenne) ,  effectuent  la  surveillance 
des  capteurs  et  les  tests  de  validation  de  toutes  les  informations. 

-  un  circuit  d' interface  tri-redondant  (pour  le  bus  tri-redondant)  , 

-  deux  circuits  d' interface  bi-redondant , 

-  deux  circuits  d' interface  pour  liaisons  unidirectionnelles 
(type  ARINC  429) . 

Une  telle  organisation  possfede  les  avantages  suivants  : 

-  une  certaine  standardisation  des  differents  modules, 

-  gestion  assez  ais4e  des  modifications  au  niveau  du  syst&me, 

-  modifications  du  logiciel  possibles  sans  interactions  multiples, 

-  fourniture  d • informations  specif iques  ais4e,  sous  une  forme  non  standard 
pour  des  utilisateurs  Isolds  , 

-  bonne  connaissance  de  la  fralcheur  et  des  caracteristlques  dynamiques  de 
1 ' information, 

-  demonstration  relativement  aisee  des  niveaux  de  securite  au  niveau  du  systfeine, 
Elle  a  par  contre  les  inconvenients  suivants  : 

-  nombre  eiev4  de  microprocesseurs , 

-  materiel  plus  important. 
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COMPARAISON  DES  DEUX  SYSTEMES 

Du  point  de  vue  du  materiel,  la  seconde  architecture  est  plus  lourde  (1  microcal- 
culateur,  plusieurs  circuits  d' interfaces  et de  memolres  suppiementaires) .  Les  avan- 
tages  et  inconvenients  compares  sont  a  priori  £quilibr£s.  Cependant,  on  doit  noter 
que  les  deux  architectures  ne  fournissent  pas  du  tout  la  m£me  nature  d' information  : 
la  premiere  fournit  des  informations  brutes  et  non  valid4es  ;  la  deuxi^me  est  capa¬ 
ble  de  fournir  £  la  fois  les  informations  brutes  et  les  paramfetres  eiabores  ainsi 
que  leur  validity. 

Pour  pouvoir  faire  des  comparaisons  exactes,  11  faut  done  prendre  en  compte  la  part 
de  calculateur  central  mobilis4e  pour  1 ' an4mobarom4trie .  Cela  est  aussi  valable  pour 
le  logiciel  et  la  complexity  du  logiciel  int4gr4  n'est  pas  facile  h  appr4hender, 

L'enqu@te  men4e  aux  Etats-Unis  et  en  France  auprfes  des  Services  Officiels  et  des 
avionneurs  de  ces  pays,  en  1980,  a  indique  qu'une  majority  semblait  se  d4gager  pour 
la  solution  4  calculateurs  specif iques.  L' importance  donn^e  h  la  demonstration  de  la 
security  d'un  logiciel  serait  done  determinante .  II  faut  noter  cependant  que  le  con¬ 
cept  d 'architecture  integree  pourrait  @tre  utilise  dans  certains  pro jets  oti  la  comple¬ 
xity  globale  est  trfcs  eievee,  et  une  proportion  non  negligeable  d' utilisateurs  est  en 
sa  faveur. 

11  est  tr£s  probable  que  le  choix  dependra  gen4ralement  du  type  d'appareil. 


CONCLUSION 

L' etude  generale  des  moyens  anemobarometr iques  pour  avions  de  la  prochaine  generation 
a  permis  d* identifier  les  tendances  des  besoins  4  venir  pour  les  paramfetres  anemoba- 
rometriques . 

Ces  param£tres  auront  dans  l'avenir  une  importance  grandissante  par  rapport  ci  l'epo- 
que  actuelle. 

Enfin,  la  prise  en  compte  de  1' ensemble  des  probl4mes  conduit  une  majority  de  per- 
sonnes  competentes  4  choisir  une  architecture  specialisee  pour  le  traitement  de  ces 
paramfctres,  par  opposition  h  une  architecture  integree  (ou  centralize) ,  bien  qu'un 
tel  concept  semble  viable  pour  certains  programmes  specif iques.  Ce  choix  semble  £tre 
dicte  par  des  questions  de  gestion  de  developpement  de  syst^mes. 
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SUMMARY 


The  Utility  Systems  of  an  aircraft  have  been  analysed  and  shown  to  benefit  considerably  from  integration 
into  a  connected  system  with  shared  processing  resources.  The  MIL-STD-1553B  data  bus  has  been  selected 
as  the  most  cost  effective  tool  for  integration  but  raises  problems  connected  with  ensuring  the  safety  of 
the  aircraft. 

Careful  design  of  the  data  bus  components  and  controllers  with  particular  attention  being  paid  to  Built- 
In-Test  techniques  and  in  the  functional  segregation  of  the  interfaces,  subsystems  and  computing 
facilities  has  allowed  a  sufficiently  reliable  system  io  be  designed  and  this  is  now  entering  full  scale 
development. 


1.  INTRODUCTION 


High  integrity  applications  of  Data  Bus  technology  in  recent  years  have  usually  postulated  the  use  of 
specially  modified  or  newly  designed  signalling  formats  or  architectures,  or  have  been  restricted  to 
the  use  of  straightforward  serial  point-to-point  links. 

With  this  paper  we  hope  to  show  the  practical  work  which  has  been  done  and  to  show  analytically  that, 
for  some  applications,  it  is  possible  to  use  the  now  widespread  MIL-STD-1553B  Serial  Time  Division 
Multiplex  Data  Bus  as  the  data  transfer  medium  in  a  safety  critical  system. 

The  components  used  are  those  designed  purely  to  meet  the  standard,  but  some  of  the  techniques  used 
are  necessarily  specific  to  the  application  and  its  particular  integrity  requirements. 

The  systems  description  is  presented  here  to  enable  other  users  to  benefit  from  our  experiences  and 
to  appreciate  the  reasons  behind  the  design  decisions. 

2.  APPLICATION 


The  particular  application  which  will  be  used  as  an  example  of  the  Multiplex  Data  Bus  in  a  High 
Integrity  System  is  that  of  an  Integrated  System  for  control  of  aircraft  Utility  Systems.  The  Utility 
Systems  are  those  subsystems  that  perform  the  basic  mechanical  functions  of  the  aircraft  and  contain 
an  element  of  logical  or  closed  loop  electronic  control. 

These  functions  have,  in  the  past,  been  controlled  by  separate,  independent  items  of  hardware. 
Typically  the  functions  are  included  in  the  following  major  subsystems; 

Powerplant 

Hydraulic 

Fuel 

Environmental  Control 
Secondary  Power 
Electrical  Power 

In  all,  these  major  headings  may  encompass  some  30  to  AO  minor  subsystems  which  are  listed  in 
Table  1.  In  a  typical  aircraft  these  subsystems  require  a  large  number  of  inputs  and  outputs, 
examples  of  which  can  be  observed  in  Table  2.  The  aircraft  may  depend  on  the  correct  functioning  of 
many  of  these  subsystems  for  safe,  continued  operation. 

In  the  context  of  modem  aircraft  projects  using  advanced  cockpits  and  data  transmission  systems  a 
method  of  integrating  Utility  Systems  into  the  overall  Avionic  architecture  has  been  proposed  (1) 
which  takes  the  general  form  shown  in  Figure  1. 

This  design  allows  Utility  Systems  to  be  integrated  with  the  aircraft  Data  Transmission  Systems  and 
enables  the  mechanical  systems  to  be  interfaced  with  advanced  cockpits. 

The  use  of  a  data  bus  for  interconnection  of  a  small  number  of  units  performing  the  tasks  of  data 
acquisition,  load  power  control  and  the  performance  of  control  algorithms  allows  significant  benefits 
to  be  obtained  in  hardware  weight,  volume  and  numbers. 
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TABLE  1  -  UTILITY  SYSTEMS  LIST 


A.  POWERPLANT  SYSTEMS 


T.  Engine  Start 

5. 

Fire  Detection 

2.  Ignition  Mangement 

6. 

Fire  Suppression 

3.  Engine  Speed  Switch 

7. 

Ice  Detection 

4.  Thrust  Reverse  Control 

8. 

Intake  De-Icing 

B.  HYDRAULIC  SYSTEMS 

1.  Hydraulic  Control 

5. 

Undercarriage  Indication 

2.  Hydraulic  Utilities 

6. 

Brakes  and  AntiSkid 

3.  Hydraulic  Depressurization 

4.  Undercarriage  Control 

7. 

Nosewheel  Steering 

C.  FUEL  SYSTEM 

1.  Fuel  Gauging 

4. 

Flight  Refuelling  Probe 

2.  Fuel  Management 

5. 

Fuel  Indications 

3.  Fuel  Feed  Control 

6. 

Hit  Detection 

D.  ENVIRONMENTAL  CONTROL 

I.  Cabin  Temperature  Control 

5. 

Air  System  Protection 

2.  Equipment  Bay  Cooling 

6. 

Air  System  Indications 

3.  Coolant  Control  System 

7. 

Nuclear/Biological 

4.  On  Board  Oxygen  Generation 

Protection 

E .  SECONDARY 

POWER  SYSTEMS 

1.  Auxiliary  Power  Unit 

3. 

Gearbox  Control 

2.  Emergency  Power  Control 

4. 

Secondary  Power  Cooling 

F.  ELECTRICAL  POWER 

1.  Power  Generation  Control 

Z. 

Power  Distribution 

G.  MISCELLANEOUS 

1.  External  Lights 

6. 

Canopy  Demist 

2-  Internal  Lighting 

7. 

Arrestor  Hook 

3.  Probes  Heating 

8. 

Brake  Parachute 

4.  Windscreen  Heating 

5.  Canopy  Control 

9. 

Rain  Dispersal 

TABLE  2  -  TYPICAL  INPUT/OUTPUT  TYPES 


Type 

Quantity 

INPUTS 

Discrete  Data 

123 

Pulse  Probes 

4 

Analogue  Sensors 

65 

Level  Sensors 

25 

OUTPUTS 

Discrete  Data 

26 

Power  Control 

93 

Analogue 

17 

Exci tation 

56 
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3.  SYSTEM  OBJECTIVES 

The  main  objectives  of  integration  are  to  obtain  benefits  in  some  or  all  of  the  following: 

Reduced  Systems ,Mass 
Reduced  Overall  System  Volume 
Reduced  System  Cost 
Improved  Maintainabt li ty 
Improved  Fault  Tolerance 
Consistency  in  Design 
Coimonality  of  Equipment 
Flexibility  in  Development 
Increased  Reliability 
Reduced  Pilot  Workload 
Improved  Systems  Performance 

Some  of  these  benefits  have  been  quantified  in  early  Utility  Systems  Studies  (2).  In  addition  to  the 
easily  quantifiable,  physical  benefits,  the  increasing  complexity  of  aircraft  projects  demands  more 
automation  and  less  pilot  intervention  in  low  level  tasks.  Thus  the  Utility  Systems  are  heading 
toward  more  complex  control  tasks,  using  the  power  of  digital  processing  to  achieve  system  objectives. 
Opportunities  for  reduction  in  pilot  workload  are  limited  but  some  reductions  in  tasks  under  emergency 
conditions  have  been  estimated  (3). 

The  work  conducted  in  the  study  of  Utility  Systems  management  at  British  Aerospace,  Warton  found  that 
the  majority  of  these  objectives  could  be  achieved.  The  major  problem  was  associated  with  the  safety 
of  the  system,  with  particular  emphasis  on  the  behaviour  of  the  system,  and  the  effect  on  the  aircraft, 
of  a  total  data  bus  failure.  Suitable  design  of  the  external  system  circuitry,  and  the  specification 
of  a  minimum  set  of  requirements  that  must  be  met  in  order  to  safely  continue  to  operate  the  aircraft 
allowed  a  safe  system  to  be  designed.  However,  some  sacrifices  had  to  be  made  in  the  overall  systems 
design  and  the  resulting  system  did  not  make  full  use  of  the  potential  savings  offered  by  maximum  use 
of  the  data  bus  for  inter-system  data  communication. 

4.  UNIQUE  FEATURES  OF  UTILITY  SYSTEMS 

The  Utility  Systems  display  certain  characteristics  that  require  a  different  approach  to  integration 
compared  to  that  used,  for  example,  on  Avionic  or  Flight  Control  Systems. 

(a)  The  subsystems  are  essential  for  the  continued  and  safe  operation  of  the  aircraft  -  they  are 
safety  critical  rather  than  merely  mission  critical,  for  example  Engine  Relight,  Brakes  and  Fuel 
Management. 

(b)  The  externally  connected  components  of  the  systems  are  essentially  simplex  in  nature  and  the 
systems  do  not  lend  themselves  to  multiple  redundant  control  methods. 

(c)  There  are  a  large  number  of  dependent  and  independent  variables  within  the  total  system  leading 
to  a  large  number  of  connected  devices  as  illustrated  in  Table  2. 

(d)  The  characteristics  of  the  systems  are  such  that  considered  separately  their  independent 
integrity  requirements  are  low,  but  in  an  integrated  system  the  possibility  of  multiple  systems 
loss  tends  to  raise  the  required  integrity.  For  example  the  Arrestor  Hook  is  a  relatively 
unimportant  item  considered  in  isolation.  However,  following  a  combined  brakes  and  thrust 
reverse  failure  the  continued  operation  of  the  arrestor  hook  is  extremely  important. 

In  order  to  meet  the  individual  system  safety  requirements  care  is  needed  in  the  design  of  the 
externally  connected  subsystem  components  and  in  the  subsystem  design  philosophy  to  enable 
reversionary  modes  to  be  incorporated  to  absorb  a  number  of  faults  without  endangering  the  aircraft. 

To  this  end  a  policy  of  functional  segregation  has  been  applied.  Subsystem  functions  can  be 
separated  at  the  gross  level  by  splitting  them  between  Systems  Management  Processors  (SMP).  Within 
the  SMPs  further  isolation  can  be  obtained  by  the  use  of  multiple  but  separate  Central  Processor  Units 
(CPU).  Additionally,  the  interface  with  a  particular  subsystem  can  be  physically  separated  even  if 
the  control  task  is  time-multiplexed  with  others  in  a  single  CPU. 

The  isolation  of  software  into  specific  memory  areas  with  the  least  possible  interaction  between 
program  modules  is  another  segregation  principle  applied,  and  the  feasibility  of  managing  segregation 
principles  within  the  assembler  program  is  being  actively  pursued.  It  is,  of  course,  not  wholly 
possible  to  separate  the  programs  entirely  and  recovery  routines  can  be  written  into  the  executive 
program,  which  queues  the  tasks,  to  prevent  any  single  software  failure  in  a  control  task  causing  a 
total  processor  loss.  Reversionary  data  values  can  be  preprogrammed  or  statistically  calculated 
should  real  data  not  be  available  for  any  reason. 

The  possibility  of  a  failure  within  a  CPU  causing  simultaneous  loss  of  control  of  a  number  of 
subsystems  has  added  another  dimension  to  the  segregation  task  and  the  example  of  Brakes,  Arrestor 
Hook  and  Thrust  Reverse  has  already  been  mentioned. 

In  particular  the  system  needs  to  be  capable  of  withstanding  the  following  failures: 

(a)  Total  loss  of  a  single  processor.  (Battle  Damage). 

(b)  Combinations  of  dissimilar  failures  in  the  total  system. 
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(c)  Total  loss  of  the  Utilities  Data  Bus. 

(d)  Total  loss  of  the  Avionics  Data  Bus. 

The  ability  to  tolerate  these  two  latter  failures  with  the  system  configured  as  in  Figure  1  using  a 
dual  redundant  mode  of  operation  is  important.  The  studies  so  far  conducted  indicate  that  many  of 
the  physical  benefits  of  Integration  in  Utility  Systems  may  be  eroded  if  triple  redundant  bus 
operation  is  used  with  its  higher  equipment  overhead  at  today's  standard  of  technology. 

Thus  the  control  of  Utility  systems,  many  of  which  are  critical  for  safe  operation  of  the  aircraft, 
requires  a  high  degree  of  fault  tolerance  of  the  Multiplex  Data  Bus  in  order  to  achieve  an  acceptable 
failure  rate  for  the  total  system. 

5.  PRACTICAL  APPLICATION 

In  the  application  of  Utility  Systems  Management  to  a  project  it  became  clear  as  a  result  of  analysis 
that  the  probability  of  a  double  bus  failure  could  be  regarded  as  a  potential  hazard  and  therefore  a 
minimum  set  of  requirements  was  established  for  the  systems  that  would  enable  the  aircraft  to  be 
flown  safely  back  to  base  and  landed  (the  “Get  You  Home"  philosophy).  Methods  of  attaining  these 
conditions  were  then  investigated  using  a  variety  of  techniques.  Typical  examples  are: 

(a)  Tolerating  the  loss  of  the  system,  for  example  the  engine  starting  system  is  not  required  once 
the  engines  are  running. 

(b)  Providing  a  method  of  recognising  the  loss  of  bus-borne  data  and  substituting  fixed  values  for 
variable  data  and  for  output  states  to  allow  continued  safe  operation. 

(c)  Avoiding  the  use  of  the  data  bus  for  safety  critical  data,  such  as  brake  pedal  position,  the 
sensors  being  hardwired  into  the  Utility  Processors. 

(d)  Providing  an  alternative  means  of  systems  operation,  for  example  emergency  undercarriage 
operation  using  a  nitrogen  bottle. 

(e)  Bypassing  Utility  Systems  Management  altogether  as  in  the  case  of  the  arrestor  hook,  which  will 
be  hardwired. 

Consideration  of  the  minimum  set  of  requirements  allowed  a  design  philosophy  to  be  developed  which 
had  a  fundamental  impact  on  the  design  of  the  total  system. 

The  resulting  architecture  can  be  seen  in  Figure  2  and  it  can  be  seen  that  the  correct  operation  of 
the  total  system  is  critically  dependent  on  the  continued  operation  of  the  data  bus. 

6.  MULTIPLEX  BUS  CHARACTERISTICS 

The  Multiplex  Data  Bus  which  has  gained  wide  acceptance  within  the  international  comnunity  as  a 
system  integration  tool  for  aircraft  mission  systems  is  that  defined  by  MIL-STD-1553B  in  the  US  and 
DEF-STAN  00-18  Part  2  in  the  UK.  Features  developed  for  its  application  also  make  it  well  suited  for 
use  in  Utility  Systems  Management  (USM)  Data  integration,  although  the  higher  integrity  constraints 
imposed  on  USM  require  that  special  Care  be  taken  over  its  implementation. 

Figure  3  shows  a  typical  multiplex  bus  implementation  for  Utility  Systems  Management.  For  high 
integrity  systems  Electro-Magnetic  Interference  susceptibility  is  minimised  by  the  use  of  transformer 
isolated  stubs  to  improve  common  mode  noise  rejection,  the  use  of  connectors  with  360°  screen 
termination  rather  than  pig-tailed  screens  and  the  use  of  double  screened  cable.  The  exact  bit  error 
rate  (BER)  for  the  bus  is  dependent  on  many  factors,  hcwever  the  Multiplex  Applications  Handbook  (4) 
suggests  that  a  BER  of  1 0“ 1 2  is  commensurate  with  noise  test  levels  which  correspond  to  a  detected 
word  error  rate  of  10"^.  Consequently  the  probability  of  corrupting  a  single  subsystem  data  item  is 
unlikely  to  exceed  5  x  10"6  per  hour.  It  is  possible  to  improve  on  this  figure  by  transmitting 
critical  data  items  two  or  more  times,  although  in  practice  it  is  felt  that  hardware  failure  rate  will 
dominate  system  reliability. 

The  multiplex  bus  protocol  provides  sufficient  checks  to  ensure  that  in-line  failures  of  the  bus  will 
be  detected  with  high  probability.  Of  greater  concern  are  the  failures  which  merely  degrade 
performance,  for  example  high  impedance  in-line  connections  and  loss  of  screen  terminations. 

Advantage  can  be  taken  of  the  wide  difference  between  detected  and  undetected  error  rates  to  enable 
the  bus  controller  to  isolate  a  faulty  bus  by  noting  an  increase  in  message  rejection  rate  before  BER 
becomes  significant. 

8attle  damage  could  represent  a  significant  threat  to  multiplex  data  bus  systems  as  severance  of  the 
bus  terminates  all  information  transfer.  However,  the  bus  is  much  smaller  in  volume  than  the  cable 
looms  it  replaces,  and  is  thus  less  likely  to  be  damaged.  By  carefully  routing  dual  redundant  busses 
in  the  airframe  to  maximise  separation  the  probability  of  losing  both  busses  will  be  made  very  small. 
The  use  of  transformer  isolated  stubs  is  made  mandatory  by  battle  damage  considerations,  as  without 
the  protection  they  afford  against  short  circuits,  remote  terminal  units  would  represent  single  point 
failure  hazards. 
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Experience  with  the  implementation  of  remote  terminal  units  (R/Ts)  has  led  to  the  following  features 
being  incorporated  to  improve  integrity: 

(a)  The  1553  protocol  forms  a  good  basis  for  checking  the  functionality  of  R/Ts.  Wrap-around 
addresses  are  designated  in  each  R/T  to  allow  complete  test  messages  to  be  routed  via  the 
subsystem  back  to  the  bus  controller  for  verification,  thus  providing  a  high  degree  of  confidence 
in  the  main  data  paths. 

(b)  The  responses  of  R/Ts  to  invalid,  illegal  or  illogical  commands  are  well  defined  in  order  to 
provide  system  integrity,  although  it  may  prove  difficult  to  test  for  compliance  in  flight.  The 
UK  has  defined  a  set  of  preferred  responses  to  these  conditions  in  the  Guide  to  the  UK  Defence 
Standard  definition  of  the  Multiplex  Data  Bus,  DEF-STAN  0Q- 18.  (5). 

(c)  Every  effort  should  be  made  in  R/T  design  to  provide  robustness.  In  addition  to  the  preferred 
responses,  terminals  also  provide  freedom  from  latch-up  and  perform  reasonability  checks  on  bus 
commands  by  implementing  the  following  features: 

(i)  Mode  code  reset  is  made  as  near  to  power-up  reset  as  possible  (for  enhanced  error 
recovery). 

(ii)  A  no-response  timeout  for  R/T  to  R/T  transfers  (to  prevent  erroneous  data  capture). 

(iii)  Parity  on  R/T  address  lines. 

(iv)  End  of  Transmission  check  prior,  to  sending  the  status  word. 

(v)  Validity  checks  on  T/R  bit,  sub-address,  and  word  count  (to  ensure  that  messages  comply 
with  subsystem  formats). 

(d)  The  R/T  is  a  potential  single-point  failure  hazard,  both  for  the  multiplex  bu-  and  the  subsystem. 
A  watch-dog  timer  is  implemented  to  prevent  a  "chattering"  R/T  from  disabling  the  bus,  provision 
being  made  to  periodically  check  its  functionality.  Although  the  bus  itself  may  be  dual 
redundant,  the  R/T  is  implemented  simplex  behind  the  immediate  wire  interface,  which  has 
previously  been  noted  as  a  potential  problem  in  high  integrity  systems  (4).  For  high  reliability 
systems  dual  redundancy  is  propagated  right  through  to  the  subsystem  at  the  cost  of  a  few  extra 
integrated  circuits. 

7.  BUS  CONTROL 


The  multiplex  data  bus  operates  under  a  conmand-response  protocol,  requiring  that  one  unit  act  as  a 
Bus  Controller  issuing  a  sequence  of  commands  to  order  data  transmission.  Consequently  the  Bus 
Controller  is  a  single-point  failure  hazard,  and  redundancy  must  be  provided  to  ensure  system 
reliability.  In  order  to  provide  adequate  reliability  the  failure  modes  of  bus  control  have  been 
analysed.  These  may  be  summarised  as: 

*  Total  Failure 

*  Partial  Failure  (e.g.  Short  cycling  or  command  corruption). 

*  Recurring  intermittent  failures. 

*  Transient  disturbance. 

*  Pattern  sensitive  failures. 

Additionally,  to  ensure  operating  integrity,  certain  mode  codes  are  avoided,  particularly  dynamic 
bus  control  hand-over  (because  of  noise  induced  errors)  and  broadcast  of  data  to  all  terminals  (as 
there  is  no  confirmatory  response  from  R/Ts). 

A  number  of  different  structures  for  the  Bus  Control  function  have  been  considered  with  various 
methods  of  fault  detection,  fault  analysis  and  fault  recovery. 

These  range  from  straightforward  simplex  controllers  to  complex  self- ' 'hitored  or  externally  monitored 
duplex  or  triplex  configurations.  It  was  quickly  recognised  that  the  simplex  unit  would  prove 
unacceptable  because  its  failure  rate  was  worse  than  the  required  probability  of  a  complete  bus 
failure. 

When  a  dual  redundant  Bus  Control  function  is  considered  it  is  necessary  to  decide  how  the  stand-by 
Bus  Controller  should  operate: 

(a)  It  may  be  in  a  pure  stand-by  mode,  where  it  is  executing  self-test  procedures  until  called  upon 
to  take  over  Bus  Control . 

(b)  It  may  split  the  task  of  Bus  Control  with  the  other  unit  on  a  time-share  basis. 

(c)  It  may  monitor  the  bus  transactions  being  conducted  by  the  other  controller. 

These  modes  of  operation  are  not  mutually  exclusive  and  a  combination  of  them  may  be  considered 
desirable. 


The  use  of  a  triplex  Bus  Controller  was  found  to  be  impractical  because  of  the  large  overhead  of 
providing  the  three  independent  processors  with  their  associated  stores,  peripherals  and  power 
supplies.  The  difficulties  of  transferring  control  between  the  three  controllers  were  also 
compounded  by  the  characteristics  of  the  data  bus  and  the  need  for  cross-checking . 

From  this  study,  two  strong  contenders  emerged.  The  first  of  these  was  the  Bus  Voter-Monitor 
architecture  shown  in  Figure  4.  The  third  element,  the  Voter-Monitor,  is  intended  to  resolve 
disputes  between  the  two  Bus  Controllers  when  they  disagree  over  their  respective  serviceabilities. 

In  order  to  achieve  this  task  the  Votor-Monitor  was  necessarily  complex,  amounting  almost  to  a  third 
Bus  Controller. 

The  second,  and  eventually  the  preferred,  option  was  to  provide  two  Bus  Controllers  with  a  high  level 
of  Built-In-Test  (BIT)  coverage.  Figure  5.  It  was  determined  that,  provided  careful  attention  was 
paid  to  BIT  coverage  and  the  design  of  circuits  to  transfer  control  in  the  event  of  a  failure,  a 
viable  Bus  Control  function  could  be  designed  to  meet  the  reliability  criteria. 

The  use  of  BIT  as  the  fault  detection  medium  can  be  shown  to  provide  considerable  improvements  in 
overall  reliability  of  the  system.  Small  improvements  in  detection  capability  provide  dramatic 
improvements  in  the  overall  reliability  of  the  system.  This  is  shown  graphically  in  Figure  6. 

The  time  required  to  execute  some  of  the  BIT  software  routines  could  make  self  testing  impractical  as 
a  background  exercise.  In  order  to  overcome  this  difficulty  a  switching  arrangement  was  introduced  to 
allow  each  bus  controller  to  generate  word  commands  on  the  bus  for  one  major  cycle  (about  1  second) 
before  passing  control  to  the  other  unit.  This  allowed  extensive  self  testing  to  be  carried  out 
during  the  non-active  period  and  also  prevented  latent  faults  in  the  stand-by  processor  causing  a 
problem. 

The  switching  circuit  itself  was  a  dual  purpose  design  which  allowed  switch-over  under  failure 
conditions  and  also  carried  out  the  major  cycle  switching.  It  operated  via  a  pair  of  dedicated  links 
between  the  Bus  Controllers  and  its  correct  functioning  under  fault  conditions  was  the  subject  of 
extensive  analysis.  It  was  designed  to  provide  unambiguous  indications  to  the  primary  Bus  Controller 
even  when  a  link  was  open  or  short  circuit  or  any  single  component  failure  occurred  including  the 
power  supply. 

In  order  to  overcome  some  of  the  limitations  of  BIT  and  also  to  provide  the  Utilities  System  with 
some  capability  when  aircraft  or  ground  power  was  not  available,  for  example  for  re-fuelling  or 
maintenance  purposes,  a  dual  power  supply  unit  was  found  to  be  necessary.  This  had  the  incidental 
benefit  of  improving  overall  reliability  because  power  supply  faults  are  notoriously  difficult  to 
accurately  detect. 

The  system  to  be  installed  in  a  new  project  at  British  Aerospace,  Warton  uses  such  a  dual  power 
supply,  control  switched  bus  controller  arrangement  ar.d  can  be  shown  to  exhibit  sufficient  reliability 
to  ensure  that  a  message  will  be  correctly  transmitted  and  received  with  a  probability  of  MD’°  per 
hour  excluding  the  effects  of  noise  on  the  signal. 

8.  SYSTEM  INTEGRITY  ANALYSIS 

The  reliability  block  diagram.  Figure  7,  shows  the  contributory  factors  affecting  the  use  of  the 
data  bus  in  this  application.  The  use  of  Large  Scale  Integration  (LSI)  in  the  Remote  Terminals 
significantly  improves  reliability  in  this  area  but  the  ultimate  success  of  the  Data  Bus  always 
depends  on  the  correct  operation  of  the  Bus  Controller. 

The  design  to  be  used  in  a  future  project  at  British  Aerospace,  Warton  has  a  calculated  Mean  Time 
Between  Defects  (x)  of  just  under  5000  hours  and  an  estimated  BIT  efficiency  (m)  of  95%. 

The  primary  Bus  Controller  will  therefore  contribute  (1-m)  x  to  the  overall  failure  rate  because  Si, 
(1-m)  faults  will  be  undetected  and  therefore  lead  to  complete  failures. 

The  switching  circuit  has  been  designed  to  operate  under  all  failure  conditions  of  the  Bus  Controller, 
including  Power  Supply  dropouts  so  that  it  will  switch  in  the  stand-by  controller  for  all  detected 
faults.  The  secondary  Bus  Controller  is  identical  to  the  primary  so  that  the  overall  failure  rate 
of  the  function  is: 

(1-m)  x  +  m\^ 

For  large  m  this  expression  is  dominated  by  the  first  term  and  is  shown  graphically  in  Figure  6. 

The  probability  of  total  loss  of  bus  traffic  for  dual  redundant  system  with  a  modest  BIT  system  can 
therefore  be  shown  to  be  better  than  10'*  per  hour. 

The  Systems  Management  Processor  block  diagram,  Figure  8,  shows  how  the  six  separate  processing 
elements  have  the  interfaces  distributed  between  them.  Each  interface  is  duplicated  and  also  has 
direct  access  to  the  bus  via  a  Remote  Terminal  should  the  controlling  Processor  fail. 

The  fully  functional  system  therefore  passes  processed  data  between  elements  and  into  the  Avionics 
Data  Bus  under  normal  control.  Should  internal  processing  elements  fail  the  Systems  Management 
Processor  has  the  capability  to  re-configure  such  that  raw  Interface  data  Is  passed  to  the  bus  and 
can  be  processed  in  a  redundant  CPU.  Subsystem  interface  failure  can  be  tolerated  because  the 
interfaces  are  duplicated  in  other  Systems  Management  Processors  with  consideration  being  given  to 
those  naturally  redundant  systems  within  the  aircraft  to  ensure  that  no  coronon  mode  failure  hazards 
are  Introduced. 


9.  CONCLUSION 


With  this  paper  we  have  shown  the  principles  by  which  a  particular  system  can  be  designed  to  meet  a 
specific  reliability  target  with  an  existing  data  bus  standard  and  currently  available  components. 

It  is  necessarily  not  a  general  approach  to  high  integrity  data  bus  applications  but  some  of  the 
techniques  can  be  applied  to  other  systems. 

The  limitations  of  the  data  bus  have  been  highlighted  and  seme  methods  of  overcoming  them  have  been 
demonstrated  with  particular  attention  being  focussed  on  the  maintenance  of  the  bus  controller 
integrity. 

The  ultimate  limitation  of  the  data  bus  has  been  indicated  to  be  an  undetected  word  error  rate  of 
5  x  10"6  per  hour  but  at  current  levels  of  technology  this  is  swamped  by  the  probability  of  total  bus 
controller  failure.  The  aim  for  high  integrity  applications  therefore  must  be  to  improve  the 
reliability  or  SIT  efficiency  of  the  bus  controller  either  by  further  integration,  such  as  custom 
components,  or  by  improved  Built-in-Test. 

Work  conducted  to  compare  this  method  of  design  with  that  used  for  a  contemporary  aircraft  shaved  the 


following  benefits: 

Mass  reduction 

47% 

Volume  reduction 

52% 

Cost  reduction 

50% 

Additionally  improvements  are  anticipated  in  areas  such  as  Reliability,  Pilot  Workload,  Flexibility 
and  Design  Comnonality  and  Consistency. 
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I.  SUMMARY 

In  September  1981  The  Singer  Company,  Kearfott  Division  was  awarded  a  contract  to  develop  a  new  Weapons 
Navigation  Computer  (AN/AYK-I8)  to  provide  the  F-1 1 1  with  an  upgraded  central  computer  to  serve  through  the  1990’s. 
The  goals  for  this  computer  were  increased  computational  capability,  increased  reliability,  operability  with  existing 
(CP-2/CP-2  EX)  and  future  (MIL-STD- 1750)  Instruction  Set  Architectures  (ISA’s),  and  form,  fit  and  function 
compatibility  with  its  AN/AYK-6  predecessor.  By  the  systematic  application  of  design,  performance  and  cost  trade-offs 
described  in  the  paper,  all  essential  goals  have  been  achieved  and  USAF  flight  tests  have  commenced  one  year  after 
contract  award. 

Computational  capability  improvement  was  achieved  by  using  a  32-bit  Central  Processor  Unit  (CPU),  memory  and 
local  bus  and  a  16-bit  bus  and  architecture  for  the  remainder  of  the  computer.  Reliability  was  improved  by  employing 
Kearfott's  hollow  card  cooling  concept  and  thereby  keeping  all  components  well  below  their  critical  temperatures.  The 
ISA's  for  both  AN/AYK-6  and  AN/AYK-18  were  embedded  in  microcode  and  selectable  by  software.  The  resultant  WNC 
has  an  affordable  production  cost,  can  emulate  the  required  ISA’s,  has  a  predicted  reliability  of  over  3000  hours,  a 
throughput  of  462  KOPS,  Built-In  Test  (BIT)  to  the  card  (SRU)  level  and  is  interchangeable  with  the  AN/AYK-6. 

2.  INTRODUCTION 

The  present  day  multi-mission  aircraft,  containing  sophisticated  avionics  for  fire  control  and  navigation,  has 
created  a  need  for  compact,  highly  efficient,  and  reliable  Central  Digital  Computers.  This  paper  describes  the  USAF 
F-1 11  WNC  (AN/AYK-18)  and  the  design  methodology  and  some  of  the  performance  optimization  techniques  utilized  in 
its  development. 


3.  F-  111  WNC  GOALS 

The  computer  avionics  currently  in  the  F-1 11  aircraft  are  of  a  mid-to-late  1960’s  design  vintage  and  are  not 
representative  of  today's  technology  in  either  performance,  reliability  or  cost.  Based  on  the  need  to  update  the 
performance  capability  of  the  F-1  II  fleet  in  light  of  the  continued  use  of  this  aircraft  well  into  the  1990's,  the  US  Air 
Force  defined  a  set  of  demanding  improvement  goals  for  the  F-1 11  WNC  (AN/AYK-18).  These  goals  include  the 
following: 

•  A  throughput  increase  to  450  KOPS,  at  least  a  factor  of  three  improvement  over  the  original  AN/AYK-6 
machine. 

•  A  memory  size  increase  of  four- fold,  from  16K  to  64K  words.  This  growth  will  allow  room  for  program 
expansion  to  enhance  operational  capability. 

•  A  five-fold  increase  in  Mean  Time  Between  Failure  (MTBF)  to  a  minimum  of  2,000  hours  while  operating  in 
the  same  environment. 

•  An  extended  ISA,  CP-2  EX#  to  provide  floating  point  and  integer  arithmetic  for  higher  order  language 
capability.  At  the  same  time  an  effective  emulation/translation  capability  was  required  for  AN/AYK-6 
instructions  to  permit  low  risk  conversion  of  current  flight  software.  In  addition,  the  computer  must  achieve 
a  simple  conversion  to  the  MIL-STD-  1750A  ISA,  since  a  transition  of  operational  flight  programs  to  the  Air 
Force  Standard  ISA  is  required. 

•  An  Input-Output  (I/O)  which  maintains  the  parallel  bus  structure  of  the  AN/AYK-6  and  in  addition  contains  a 
dual  redundant  MIL-STD- 1 553B  MUX.  The  addition  of  MIL-STD- 1 553B  capability  allows  the  computer  to 
interface  with  future  equipment  having  a  MIL-STD-  1553B  capability. 

•  An  enhanced  BIT  capable  of  providing  a  probability  of  0.90  that  a  failure  will  be  isolated  to  an  SRU.  To 
facilitate  maintainability  and  identification  of  the  faulty  SRU  a  latched  mechanical  indicator  display  must  be 
provided. 

These  goals  were  to  be  implemented  in  a  form/fit  replaceable  Line  Replaceable  Unit  (LRU)  providing  for  minimum 
impact  on  current  operational  readiness  of  aircraft  in  use  when  installation  is  performed.  No  modification  to  aircraft 
wiring  or  structure  was  to  be  be  necessary,  thus  requiring  little  or  no  aircraft  downtime  for  retrofit. 

The  above  mentioned  improvements  were  to  be  achieved  in  a  computer  configuration  producible  at  a  low  enough 
recurring  cost  for  the  quantity  of  525  units  to  justify  the  program  on  a  Life  Cycle  Cost  (LCC)  basis. 


CP-2  extended;  CP-I  is  the  ISA  of  AN/AYK-6 


4.  DESIGN  APPROACH 


In  September  1981,  The  Singer  Company,  Kearfott  Division  was  awarded  a  contract  lor  the  design,  development 
and  production  of  the  AN/A YK- 18  Computer  (Figure  I). 

The  design  process  commenced  with  a  detailed  examination  of  the  customer  requirements  by  a  team  of  designers 
and  support  personnel  to  devise  a  series  of  design  approaches  or  goals  that  would  satisfy  the  specifications  and  the 
underlying  customer  need. 

Some  of  the  more  significant  tasks  faced  by  the  design  team  that  required  approach  resolution  were  to: 

«  Minimize  the  MIL-STD-  I7  50A  retrofit  program 

•  Minimize  Intermediate  Level  Automatic  Ground  Equipment  (AGE)  and  AGE  data 

•  Modify  the  SKC-31  32  rnultitarget  emulator  for  CP-2  EX  and  17 50 A  architectures 

•  Examine  and  select  production  techniques  best  suited  to  this  program 

•  Minimize  recurring  tost 

•  Substantially  improve  MTBF  without  compromising  cost,  maintainability  and  ability  for  retrofit 

•  Make  or  buy  core  memories  to  the  required  cost,  configuration  and  performance. 

Fallowing  is  a  brief  div  ussion  of  ea<  h  of  the  above  issues  and  the  approach  selected.  Trade-offs  are  discussed  ir 
Section  5. 


Retrofit  Program  for  MIL  -  STD- 1 7  5QA  ISA 

Although  the  F-  111  WNC  had  required  operation  only  with  the  CP-2  EX  ISA,  the  Air  Force  planned  and  required 
that  a  switchover  be  made  to  tf**.  MIL-STD- 1 7 50 A  ISA  at  some  later  date.  They  envisioned  that  the  retrofit  switchover 
would  consist  of  replacing  one  or  more  cards  in  the  CPC  and  performing  an  acceptance  test  procedure  after  the  ki:\ 
were  installed  m  the  field.  A  cost-effective  approach  of  having  both  ISA's  coresident  in  microcode,  developed  b\ 
Kearfott,  eliminated  the  entire  retrofit  program  requirement. 

Minimization  of  Intermediate  Level  Test  Equipment  and  its  Su 


Intermediate  level  test  equipment  to  isolate  a  malfunctioning  SRU  in  the  field  usually  requites  considerable 
expenditures  for  test  stations,  fixtures  and  supporting  software.  If  the  computer  is  properly  designed,  particularly  with 
respect  to  partitioning  and  by  the  selective  addition  of  BIT  circuitry,  an  internal  SRU  fault  isolation  capability  can  be 
achieved.  The  cost  in  BIT  hardware,  not  counting  some  utilization  of  microcode  and  core  memory  assets  should  be 
significantly  less  than  $1000  per  production  unit  to  be  cost-effective.  This  technique  was  successfully  adopted  for  the 
WNC,  thereby  eliminating  the  need  for  Intermediate  Level  Test  Equipment. 

Multitarget  Emulator 

The  development  of  a  computer  for  Kearfott  in-house  programs  and  forthcoming  procurements  like  the  F- 1  1 1  WNC 
resulted  in  a  versatile  processor  with  the  ability  to  emulate  other  computers.  This  emulator  offered  an  excellent 
response  to  this  requirement.  To  be  performed  efficiently,  emulation  of  computers  (in  addition  to  microcode  format) 
requires  a  flexibility  of  data  paths  and  sufficient  hardware  in  the  form  of  registers,  shifters,  multipliers,  etc.  This 
approach  required  that  additional  hardware  be  provided,  but  the  cost  was  relatively  low  when  compared  to  the  flexibility 
achieved.  The  Kearfott  SKC-31 32  CPU  designed  as  a  multi-target  emulator  for  our  in-house  JTIDS  program  with  the 
Kearfott  ISA  has  successfully  emulated  other  ISA's,  including  the  IBM  CP-2  EX  and  the  USAF  MIL-STD-  17 50A,  Notice  I. 

Examination  of  Production  Techniques 

The  predominant  factor  in  the  cost  of  the  F-lll  WNC  program  was  the  recurring  cost  to  build  and  test  525 
production  systems.  As  a  direct  result  the  material  and  labor  costs  required  careful  scrutiny.  Various  modes  of 
fabrication  were  examined  to  ascertain  the  optimum  approach.  Dual  In-line  Integrated  Circuit  (1C)  Packages  (DIP'S), 
presently  cheaper  than  flatpacks  or  chip  carriers,  automatically  inserted  and  wave  soldered  provided  the  most  cost 
effective  fabrication  technique. 

Design  To  Cost  (PTC) 

A  rigorous  DTC  activity  was  invoked  and  adhered  to.  Trade-offs  with  respect  to  circuit  design,  assembly  and  test 
were  weighed  against  production  cost.  In  some  cases  additional  hardware  was  allowed  to  be  added,  e.g.,  SRU  Built-In 
Test  Equipment  (BITE),  because  the  increased  cost  of  hardware  was  far  less  than  the  eliminated  Intermediate  Level  AGE. 
The  resulting  low  recurring  per  unit  cost  was  the  direct  result  of  this  activity. 

Substantial  Improvement  in  MTBF 

The  importance  of  achieving  major  improvement  in  reliability  was  a  driving  force  in  the  trade-off  decisions 
relating  to  the  mechanical  configuration  of  the  AN/AYK-18.  Particular  emphasis  was  placed  on  cooling  since  the  MTBF 
of  an  Integrated  Circuit  (1C)  is  influenced  in  a  major  way  by  its  operating  temperature.  A  reduction  of  20°C  in  the 
operating  temperature  of  an  1C  wiJJ  almost  double  its  MTBF.  If  conductive  heat  removal  methods  are  used,  they  become 
less  effective  as  card  size  increases.  On  the  other  hand,  a  large  card  means  fewer  intercard  connections  which  improves 
reliability.  The  trade-offs  were  made  among  cooling  method,  card  size,  mechanical  stiffness,  soldering  method,  ease  ol 
inspection,  etc.,  to  maximize  MTBF. 

The  MTBF  for  the  F-  1 1 1  WNC  is  calculated  to  be  in  excess  of  3000  hours.  A  similarly  constructed  unit,  the  F-lll 
Advanced  Microelectronic  Converter  (AMC)  has  actually  surpassed  its  calculated  MTBF  of  1200  hours  in  the  field;  its 
operational  MTBF  is  over  1400  hours. 

Core  Memory  Modules 


Although  Kearfott  has  designed  and  built  memory  modules,  it  was  decided  for  reasons  of  non-recurrmg  and 
recurring  cost  savings  to  use  militarized,  multisourced  32  K  word  by  18-bit  modules  which  fulfill  this  requirement.  Such 
modules  are  available  from  EM«5tM,  Quadri,  and  Fabritek. 


5.  DESIGN  TRADE-OFFS 


In  the  preceding  section  we  reviewed  a  number  of  critical  items  requiring  unique  design  approaches  to  develop  the 
optimum  computer  configuration  and  discussed  in  a  summary  manner  the  approach  selected.  In  the  following  section  we 
have  selected  a  limited  number  of  significant  subjects  for  discussion  of  the  technical  trade-offs  conducted  by  the 
designer  in  arriving  at  a  final  configuration. 

5.1  CPU  ARCHITECTURE  TRADE-OFFS 


The  design  of  the  CPU  was  driven  by  three  major  requirements;  performance,  self-test  and  fault  isolation,  and  the 
ability  to  emulate  three  architectures.  All  of  the  above,  while  essentially  independent,  exhibited  a  significant 
interrelationship  during  the  trade-off  activity. 

The  most  fundamental  performance  requirement  which  was  addressed  was  that  of  throughput.  It  is  generally 
accepted  that  an  arithmetic  unit,  memory,  and  data  bus,  each  32  bits  wide,  will  result  in  higher  speed  execution  for 
double  length  instructions  such  as  floating  point  and  double  precision.  It  is  equally  recognized  that  such  an  architecture 
will  be  more  costly  and  complex,  and  not  cost-effective  in  the  areas  of  I/O  and  AGE  interfaces  which  are  not  usually 
required  to  operate  at  the  highest  word  rate.  The  resulting  architecture  was  a  compromise  employing  a  32-bit  CPU. 
memory,  and  local  bus  with  the  remaining  elements  of  the  computer  employing  a  16-bit  bus  and  architecture. 

Other  speed  enhancement  techniques,  such  as  pipelining  and  look-ahead  memories,  were  rejected  because  their 
added  cost  and  complexity  were  considered  unwarranted  for  the  specified  performance  and  cost  targets. 

The  design  of  the  microprogram  control  section  was  critical  to  the  successful  achievement  of  the  performance, 
emulation  and  self-test  goals.  An  extra  wide  format  was  selected  to  provide  optimized  solutions  to  each  of  these  three 
requirements.  The  broad  parallel  organization  permitted  all  essential  logical  decisions  to  be  performed  simultaneously, 
thereby  meeting  the  emulator  goal  with  no  degradation  in  computer  performance.  A  microcode  memory  capacity  of 
4096  words  was  selected  which  provided  sufficient  memory  for  both  required  architectures  and  built- in  test  and  fault 
isolation. 

Another  concern  was  the  method  to  be  employed  to  "select"  the  particular  architecture  in  which  the  machine  was 
to  operate.  Candidate  solutions  included  a  protected  front  panel  switch,  a  unique  jumper  in  the  chassis  which  could  be 
removed  to  accomplish  the  architecture  transition,  or  a  software  switch  transparent  to  the  hardware.  The  latter 
approach  was  selected  and  implemented  through  a  microcode  test  of  a  word  in  the  software  load  module  which  indicated 
to  the  microcode  which  architecture  was  to  be  executed.  This  technique  makes  all  computers  interchangeable  and 
reversible  with  regard  to  the  selected  architecture. 

In  addition,  the  requirements  for  dual  architecture  imposed  significant  constraints  on  the  design  of  the  I/O 
channels.  The  differences  between  the  two  architectures  required  that  any  logic  operated  in  conjunction  with  the  CPU 
be  capable  of  accommodating  the  same  basic  I/O  instructions  in  both  architectures. 

The  goal  of  fault  isolation  to  an  SRU  was  addressed  during  early  stages  of  design  in  the  partitioning  of  the  logic  to 
be  olaced  on  each  circuit  card.  It  was  identified  early  in  the  program  that  if  the  goal  of  fault  isolation  was  to  be  truly 
met,  each  SRU  must  be  carefully  partitioned  so  that  its  function  is  uniquely  located  on,  and  limited  to,  one  SRU.  Upon 
satisfying  this  requirement,  faults  were  categorized  into  those  which  could  be  detected  by  software  and  those  which 
would  disable  the  CPU/memory  relationship,  making  normal  operation  impossible.  The  latter  category  of  fault  was 
assigned  to  the  microcode  for  fault  isolation.  One  of  the  first  tasks  of  the  microcode  at  computer  turn-on  is  to  ensure 
that  the  CPU  and  memory  are  operating  properly  enough  to  guarantee  that  the  subsequent  software  self-test  would  be 
effective  and  accurate. 

5.2  MEMORY  ARCHITECTURE  TRADE-OFFS 

The  F-ill  WNC  memory  requirement  was  to  provide  a  non-volatile  core  memory  of  65,536  words,  18  bits  per  word 
(16  data  bits  plus  1  parity  bit  and  I  write  protection  bit).  Several  factors  were  considered  in  the  design  of  the  memory 
Organization: 

•  The  memory  access  and  cycle  times  were  specified  to  be  350  and  900  nanoseconds  maximum,  respectively, 
which  is  typical  of  available  hardware.  This  speed  limitation,  unless  circumvented  architecturally,  would 
preclude  meeting  the  throughput  specification. 

•  A  32  -  bit  bus  permits  two  memories  to  be  operated  concurrently  such  that  one  memory  access  provides  two 
words  of  data/instruction  in  350  nanoseconds.  The  double  word  data  is  particularly  important  when 
performing  floating  point  or  double  precision  fixed  point  operations. 

The  above  factors  were  considered  and  resolved  in  the  following  fashion.  Although  64  K  x  18  modules  offered  a 
reduced  cost  approach,  their  use  did  not  permit  meeting  the  throughput  specification  of  4  50  KOPS.  Performance  could 
have  been  increased  by  additional  changes  in  the  processor,  either  look-ahead  or  faster  clock  speed  but  the  increased 
complexity  of  the  hardware  in  the  processor  negated  this  approach.  The  use  of  two  32  K  x  18  modules  and  the  32-bit  bus 
was  the  selected  approach.  With  the  one  word  look-ahead  instruction  capability  of  the  32-bit  memory  access,  plus  the 
availability  of  double  precision  data  for  floating  point  and  fixed  point  operations,  the  performance  increased  to  462 
KOPS,  meeting  the  specification  requirement,  while  using  multisourced  available  memories.  This  permitted  competition 
among  several  suppliers  and  a  lower  cost  product  was  the  direct  result. 

5.3  BIT  TRADE-OFFS 


A  major  element  of  cost  in  the  F-lll  WNC  program  was  the  requirement  to  provide  a  Support  Equipment  ($E) 
capability  at  the  Intermediate  Level  (1-Level)  of  maintenance  where  the  SE  was  required  to  verify  computer 
malfunctions  and  to  identic  the  failed  SRU.  The  non-recurring  cost  to  design  the  SE  plus  the  recurring  cost  to  fabricate 
eleven  sets  of  hardware  and  data  would  have  cost  sever*!  million  dollars.  Comprehensive  trade-off  reviews  resulted  in  a 
design  approach  on  the  F-lll  WNC,  whereby  the  SRU  fault  isolation  was  internal  to  the  LRU  thereby  eliminating  the 
requirements  for  SE,  an  approach  which  to  our  knowledge  had  never  been  applied  to  an  airoorne  digital  computer. 
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j.U  SOFTWARE 

The  software  trade-off  and  decision  process  was  more  a  user  task.  It  is  included  here  for  the  sake  of  completeness. 

On  the  system  level,  the  principal  software  task  was  the  adaptation  of  existing  flight  proven  software,  which  runs 
c-n  the  original  AN/AYK-6  computer,  to  run  on  a  new  enhanced  computer.  It  was  also  desired  that  the  upgrade  and 
expansion  of  the  program  be  performed  using  the  JOVIAL  (J7  3)  high  order  language  to  enhance  the  maintainability  of  the 
flight  software.  All  this  was  to  be  achieved  without  compromising  any  delivery  commitments  for  flight  software  in  the 
various  operational  F-lll  aircraft.  Toward  that  end.  the  Air  Force  devised  a  clever  plan  for  achieving  the  desired  goals 
in  a  gradual  manner,  minimizing  schedule  risks. 

The  enhanced  flight  computer  AN/AYK-jS  provides  the  Air  Force  with  a  MIL-STD-  17 50A  ISA  capability-  To 
facilitate  the  software  transition,  the  new  computer  also  provides  a  bridge  ISA,  CP-2  EX.  which  retains  substantial 
compatibility  with  the  CP-2  ISA  but  which  also  included  several  new  features  found  in  the  MIL-STD- I750A  ISA.  As 
mentioned  earlier,  Kearfott  designed  the  computer’s  microcode  to  be  swutchable  between  these  two  ISA's  under  the 
control  of  :  single  word  in  the  computer's  main  memory. 

Using  these  design  concepts,  the  software  conversion  would  proceed  in  the  following  manner: 

1)  Convert  all  existing  flight  programs  from  CP-2  Assembler  code  to  CP-2  EX,  largely  via  the  use  of  an 
automatic  translator  program.  Kearlott  developed  a  translator  via  its  general  purpose  macroprocessor 
program  which  achieved  98%  effectiveness. 

2)  Flight  test  the  new  programs  and  release  them  to  operational  use  as  required. 

3)  In  a  gradual  manner  (usually  as  part  of  the  normal  update  cycle!,  convert  modules  in  the  existing  flight 
programs  to  the  JOVIAL  (37 3)  language.  Kearfott  and  Proprietary  Software  Systems  are  developing  a  ]7! 
compiler  which  generates  CP- 2  EX  Assembler  code  for  rhjs  purpose. 

4)  Once  a  major  portion  of  an  F-lll  flight  program  has  been  converted  to  the  JOVIAL  language,  recompile  the 
J7  3code,  rewrite  the  few  remaining  CP- 2  EX  modules  into  MJL-STD- P50A  language,  retest  and  release  the 
complete  1750A  flight  programs. 

This  process  provides  both  immediate  capability  via  the  CP-2  EX  ISA  and  eventually  full  Air  Force  Standard 
capability  (using  MIL-STD- 17  50A  and  JOVIAL)  with  essentially  no  schedule  risk  for  interim  releases  of  the  F-lll  flight 
programs. 

5.5  ELECTRONIC  PACKAGING  TRADE-OFFS 

Specification  requirements,  reliability,  cost  and  maintainability  represent  the  major  factors  to  be  considered  in 
selecting  the  features  that  are  to  be  incorporated  in  the  mechanical  design  of  an  avionics  package.  In  addition,  schedule 
requirements,  tooling  needs,  and  the  capabilities  of  the  manufacturing  facility  must  be  evaluated  before  a  final  decision 
is  made. 

The  above  considerations  plus  the  extensive  design  and  manufacturing  experience  with  a  variety  of  packaging 
philosophies  employed  in  Kearfott's  varied  product  mix,  coupled  with  continuing  research  and  development  in  advanced 
packaging  techniques,  provided  a  sound  basis  for  the  trade-offs. 

The  most  significant  trade-off  factor  in  determining  system  reliability  is  component  operating  temperature.  A 
10°C  decrease  in  component  temperature  may  raise  the  MTBF  by  1  5  to  30%.  The  type  of  component  case  used,  i.e.,  a 
flatpack  or  DIP,  has  a  significant  effect  on  system  cost.  The  use  of  the  DIP  in  preference  to  flatpacks  results  in 
component  procurement  and  assembly  cost  savings  in  excess  of  20%,  however,  a  concomitant  volume  penalty  of  as  much 
as  50%  may  have  to  be  absorbed.  The  method  used  for  interconnection  between  the  circuit  card  modules,  and  between 
the  backplane  and  external  connectors,  also  affects  cost  and  reliability.  The  use  of  large  cards  reduces  the  number  of 
connector  pins,  which  in  turn  enhances  reliability  and  reduces  cost.  In  the  dynamic  environment  experienced  by  avionic 
equipment,  a  rigid  card  and  chassis  construction  is  preferred  in  order  to  limit  card  displacement.  Soft  construction  and 
subsequent  I?.rge  card  displacements  lead  to  solder  joint  failures  and  connector  pin  wear. 

The  F-lll  WNC  volume  and  weight  constraints  permitted  the  use  of  DJP's.  The  desire  to  use  large  cards  and 
simultaneously  achieve  optimum  cooling  of  DIP  card*  having  appropriate  structural  characteristics  presented  a 
significant  challenge.  In  order  to  exploit  the  advantages  afforded  by  the  use  of  cost-effective  DIP’S  and  large  cards,  one 
has  to  overcome  the  problems  of  structural  rigidity  and  cooling  associated  with  this  combination. 

These  problems  could  be  solved  by  two  basic  construction  techniques  which  have  been  extensively  used  at  Kearlott. 
One  utilizes  sidewall  heat  exchangers  while  the  other  employs  the  integrally  cooled  card  (i.e.,  the  hollow  card).  The  two 
techniques  are  illustrated  in  Figure  2. 

The  DIP  solid  card  is  a  somewhat  more  conventional  card  construction  employing  the  sidewall  heat  exchangers. 
The  circuit  card  contains  an  aluminum  heat  sink  to  conduct  heat  from  the  power  dissipating  devices  to  the  heat 
exchanger.  Wedge  clamps  are  employed  at  the  card  edge  to  minimize  the  contact  resistance.  One  can  appreciate  the 
fact  that  as  the  card  length  (L)  increases,  the  thermal  path  length  and  total  power  on  the  card  increases,  producing  a 
higher  temperature  drop  from  the  components  to  the  heat  exchanger.  Essentially  the  temperature  rise  to  the  center  d 
the  card  vanes  as  the  square  of  the  card  length. 

For  typical  power  densities  of  about  270  mW/in^  ,  the  temperature  for  a  solid  core  full  ATR  card  (9.0  inches  long) 
will  be  aptvoximately  I  5  to  20°C  higher  than  that  of  a  3/4  ATR  card  (6.0  inches  long).  Therefore,  using  large,  solid  core 
cards  would  compromise  system  reliability. 

Thus,  a  card  configuration  is  desired  wherein  component  temperatures  are  independen'  of  card  length.  The  desired 
high  reliability  and  the  cost  savings  associated  with  a  large  card  can  then  be  achieved.  The  Kearfott-patented  integrally 
cooled  card  module  or  hollow  card  incorporates  the«.-  desirable  features.  By  circulating  cooling  air  directly  through  the 


module  as  shown  in  the  illustration  of  the  DIP  hollow  card  (Figure  2),  the  long  conductive  path  along  the  card  length  is 
eliminated  and  component  temperatures  become  essentially  independent  of  card  size.  The  hollow  card  module  offers 
other  advantages  in  that  component  temperatures  are  not  affected  by  card  location  within  the  chassis.  Also,  cooling  air 
can  be  allocated  to  each  card  in  proportion  to  the  power  dissipated. 

The  module  construction  consists  of  two  card  mounted  to  each  side  of  a  module  frame,  which  provides  for  the 
structural  support  and  the  physical  separation  of  the  cards.  The  cooling  air  circulates  in  the  channel  between  the  cards. 
The  back  side  of  the  cards  can  be  considered  a  planar  heat  exchanger  that  provides  direct  cooling  of  the  cards. 
Relative  cooling  characteristics  of  the  two  card  designs,  illustrated  in  Figure  2,  are  tabulated  in  Table  1  which  clearly 
illustrates  the  merit  of  the  hollow  card  module  as  the  card  size  increases. 


TABLE  1. 

THERMAL  CHAR ACTERIST1CS  OF  INTEGRALLY  COOLED  CARDS  VS 
SIDE  WALL  COOLED  CARDS  OF  VARIOUS  LENGTHS 


CARD 

TYPE 

3/4  ATR  CARD 

6"  LENGTH 

FULL  ATR  CARD 

9*’  LENGTH 

POWER 

DISSIP. 

AVG.  COMP. 
CASE  TEMP. 

RELATIVE 

MTBF* 

POWER 

DISSIP, 

AVG.  COMP. 
CASE  TEMP. 

RELATIVE 

MTBF* 

WAVE  SOLDERED 

8.0  W/ 

11.3  W/ 

DIP  HOLLOW  CARD 

SIDE 

70°C 

1.07 

SIDE 

72°C 

1. 00 

WAVE  SOLDERED 

DIP  SOLID  CORE 

8.0  W 

89°C 

0.56 

11.3  W 

106°C 

0.2* 

(82°C) 

(92°C) 

•ELECTRONICS  ONLY,  AIRBORNE,  UNINHABITED  FIGHTER  ENVIRONMENT,  SAME  COMPONENT  QUANTITY  AND 
MIX  USED  THROUGHOUT 

NOTE:  I.  COOLING  AIR  TEMP  tjn  27°C,  tout  =  7I°C,  or  3»/m.n/kW 

2.  NORMALLY  THE  CARDS  CONTAIN  ALUMINUM  HEAT  SINKS.  TEMPERATURES  IN  (  )  INDICATE 
TEMPERATURES  FOR  CARDS  WITH  COPPER  HEAT  SINKS. 

In  summary,  the  trade-off  study  indicated  that  a  cost  effective  and  reliable  design  should  maximize  fard  size, 
optimize  the  component  cooling  technique,  use  a  rigid  card/chassis  construction  technique,  and  utilize  DIP’S.  Details  of 
the  implementation  are  in  Section  6.1. 


6.  F-lll  WNC  HARDWARE  DESCRIPTION 

The  F-lll  Advanced  Avionics  Digital  Computer  Complex  (DCC)  consists  of  two  Kearfott  WNC’s  and  a  Kearlott 
AMC.  This  arrangement,  shown  in  Figure  3,  provides  selective  functional  redundancy  to  enhance  the  probabihtv  of 
mission  success  and  flexibility  to  accommodate  mechanization  changes.  Figure  1  is  a  photograph  of  the  WNC  alone.  Its 
salient  physical  and  performance  characteristics  are  given  in  Table  2. 

TABLE  2. 

PERFORMANCE  AND  PHYSICAL  CHARACTERISTICS 


The  F-lll  WNC,  a  high  performance  central  processor  class  computer  in  a  single  LRU,  contains: 

•  CPU  microcoded  for  CP-2  EX  and  MIL-STD-1750A  ISA's 

•  Microcode  memory  of  4096  words  (30%  spare) 

•  Two  16-bit  processor  sections  extend  performance  capability  that  exceeds  450  KOP5  (CP-2  EX  mix) 

•  Fast  hardware  multiply  provided  for  fixed  and  floating  point  operations 

•  64  K  x  18  core  memory 

•  Two  dual  M1L-STD-! 553B  RT/BC  MUX 

•  Two  bi-directional  parallel  channels 

•  Eight  external  interrupts 

•  24  input/ 16  output  discretes 

•  Timers,  real  time  clock,  time  out  counter 

•  AGE  interface 

•  Power  supply  in  accordance  with  MIL-STD-704. 

Reliability 

•  Calculated  MTBF  is  3026  1  vs  spec  requirement  of  2000  h 

BITE 


•  Self  tests  exceeds  95%  capability  and  identifies  the  failed  SRU 
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6.1  PHYSICAL  DETAILS 


The  internal  arrangement  of  the  WNC  is  depicted  in  Figures  4  and  5.  There  are  eight  SRU's  which  are  plugged  into 
a  connector  plate  on  the  main  chassis.  Each  oi  the  two  cards  associated  with  a  module  (SRU)  frame  has  independent 
functional  connectors  and  separate  test  connectors  to  permit  card  testing  prior  to  assembly  to  the  module  frame.  Once 
plugged  in,  these  SRU's  are  clamped  in  place  between  the  front  and  rear  panels  by  four  longitudinal  bars  which  are 
located  at  each  edge  of  the  main  chassis  (see  Figure  4).  This  construction  contains  features  that  lead  to  a  low  cost, 
readily  maintainable  and  structurally  sound  chassis  assembly,  By  clamping  the  cards  along  their  four  edges  with  a  set  of 
upper  and  lower  bars,  a  rugged  box-fcoam-like  structure  is  formed  that  is  ideally  suited  for  large  cards  exposed  to  high-g 
dynamic  environments. 

The  hollow-card  construction  of  the  SRU's  is  shown  in  Figures  6  and  7.  The  annular  openings  located  at  the  sides  of 
the  frame  (see  Figure  6)  form  the  system  entrance  and  exit  cooling  air  plenums  when  the  cards  are  clamped  m  position. 
Cooling  air  is  passed  into  the  air  plenum  formed  by  these  openings  at  the  left  edge  of  the  card  frames.  Each  card  frame 
conducts  some  of  that  air  to  its  opposite  edge.  Here  the  air  is  collected  and  exits  through  the  plenum  formed  by  the 
elongated  holes  on  the  right  side  of  the  frames.  Thus  each  card  independently  receives  cooling  air  at  the  entrance 
temperature,  which  is  in  intimate  contact  with  its  interior  surfaces. 

Figure  5  shows  the  LRU  frame  with  SRU's  removed.  The  connector  plate  and  clamping  bars  are  clearly  shown  in 
this  photo.  The  set  of  lower  bars  serves  as  a  subchassis  by  retaining  the  connector  plate  and  harnessing  system.  Chassis 
maintainability  and  assembly  is  optimized  by  having  front  and  rear  panels  with  harnesses  that  plug  into  the  central 
connector  plate.  Elimination  of  cumbersome  chassis  side  walls  minimizes  cost  and  permits  complete  visibility  of  the 
interconnection  system. 

This  construction  increased  the  MTBF  by: 

•  Lower  operating  temperature  due  to  hollow  card  cooling 

•  Reduced  number  of  connectors  due  to  large  card  size 

•  Mechanical  ruggedness  due  to  clamping  of  all  SRU’s 

•  Ease  of  inspection  of  all  cards 

•  Wave  soldering  of  all  SRU's 

•  Wire  wrap  of  connector  plane. 

Based  on  experience  with  the  AMC  which  used  the  same  type  of  construction,  a  high  degree  of  confidence  exists 
that  the  MTBF  predicted  for  the  WNC  will  be  exceeded. 

6.2  FUNCTIONAL  DETAILS 

The  block  diagram  of  the  WNC  is  shown  in  Figure  8.  Of  the  eight  SRU’s.  iwo  are  identical  MUX  and  Controller 
cards.  The  types  and  quantities  are: 

QTY.  SRU  TYPE 

1  Parallel  Channels 

2  Dual  Redundant  MIL-STD-l  553B  MUX  and  Controller 

1  CPU  #1  (timing  and  control) 

I  CPU  #2  (arithmetic  and  memory  interface) 

1  Core  Memory  Module  (64  K  x  18) 

1  AGE  port,  discretes,  timers  and  miscellaneous  I/O 

1  Power  Supply. 

Figure  8  indicates  the  major  signal  flow  internal  to  the  computer  and  at  the  interfaces.  Each  of  the  major 
elements  are  interconnected  on  the  internal  computer  bus.  The  externally-controlled  parallel  channels,  the  two  MUX 
channels,  the  AGE,  and  the  CPU  are  capable  of  becoming  master  of  the  internal  bus.  The  CPU  has  the  lowest  priority, 
while  the  externally-controlled  parallel  channels  have  the  highest  priority.  Program -controlled  I/O  is  performed  at  the 
CPU  priority  level  on  the  bus. 

6.3  PARTITIONING 


The  physical  partitioning  of  the  functional  elements  was  accomplished  with  a  careful  eye  toward  isolation  of  the 
SRU  from  the  BIT  perspective.  The  CPU  is  partitioned  into  two  SRU’s  in  a  way  that  sorts  timing/control  from 
register/data  paths.  The  MUX  channels  are  independent  identical  SRU's.  Both  parallel  channels  are  contained  within  the 
same  SRU.  The  power  supply  is  packaged  in  a  single  SRU.  The  discretes  and  AGE  port  share  an  SRU. 

6.4  CPU  DESCRIPTION 


The  SKC-3132  provides  a  capability  that  is  unique  as  evidenced  by  the  following  salient  features.  It  has  a 
throughput  of  462  KOP5  with  core  memory  using  the  CP-2  EX  mix.  (For  the  DAIS  mix  the  throughput  is  509  KOPS.)  Two 
16-bit  processor  sections  are  included  to  extend  its  performance  capability  at  a  minimum  hardware  cost.  A  hardware 
multiply  is  provided  for  fixed  and  floating  point  operations.  A  20  MHz  fast  shift  register  is  used  to  speed  shift 
instructions  and  for  automatic  floating  point  normalization.  A  one-word  look-ahead  memory  is  included,  as  well  as 
additional  data  paths  to  eliminate  waiting  times  that  would  be  incurred  by  multiplexing. 

6.5  CORE  MEMORY 


The  core  memory  consists  of  two  SEMS-16  type  militarized  modules  that  are  mounted  in  a  common  assembly  to 
improve  their  cooling  characteristics.  Each  module  is  32  K  x  18  and  is  identified  as  having  an  odd  or  even  address.  Each 


memory  access  may  read  or  write  both  memory  modules  simultaneously  on  the  32- b* t  bus.  This  approach  effectively 
reduces  the  memory  access  per  instruction  by  1/2- 

All  of  these  memories  are  physically  and  functionally  interchangeable.  All  meet  the  performance  of  Table  3  and 
have  the  characteristics  shown  herein.  As  mentioned  earlier  the  SEMS-16  type  modules  are  available  from  EM&M, 
f  abritek  (MMS32),  Quadri  (Q32),  and  others.  The  availability  of  multiple  suppliers,  and  the  fact  that  all  three  units  are 
mature  designs  reduces  potential  production  schedule  and  cost  risk  while  signif  icantlv  improving  the  spares  support 
requirements  when  the  computers  are  fielded. 

All  of  the  above  memories  have  conventional  three- wire  3D  organizations.  They  use  13-  or  14-mil  wide- 
temperature  cores  with  X-Y  selection  of  32  K  words  and  sense/inhibit  loops  in  16K-word  blocks.  All  make  extensive 
used  of  monolithic  core  drivers  and  sense  amplifiers. 


TABLE  3. 

CORE  MEMORY  MODULE  CHAR ACTER1STICS 


Storage  Capacity 

32,768  words  x  18  bits 

Storage  Elements 

Wide  temperature  magnetic  cores 

Cycle  Time 

900  ns 

Access  Time 

350  ns 

Operating  Modes 

Read- Restore 

Read- Modify-  Write 

Clear-Write 

Interface 

TTL 

Sue 

9.0*'  x  6.4"  x  1.4" 

Weight 

4.0  lb 

Power  (Typical) 

35-60  W,  depending  on  operating  conditions 

6.6  MUX  BUS  CONTROLLER/REMOTE  TERMINAL  (BC/RT) 

The  BC/RT  consists  of  the  Multiplexer  Transmitter/Receiver  Module  (MTRM)  and  the  Control  Interlace  Module 
(CIM)  packaged  on  a  single  SRC.  Each  RC/RT  contains  two  independent  transnutier/rec eiver  rhannels. 

The  two-part  architecture  provides  a  flexible  and  universal  bus  type  structure,  having  the  ability  to  organize  all  the 
invariant  MIL-STD-1553  functions  into  a  set  of  high  density  circuit  elements  on  the  MTRM.  The  bus-oriented 
architecture  of  CIM  provides  rapid  data  transfer  and  manipulation  between  itself  and  the  host  CPC  and  memory  module. 

6.7  BITE 

The  BITE  is  capable  of  detecting  over  95%  of  all  component  faults.  In  addition,  it  will  identify  the  faulty  SRI'  on 
the  front  panel  indicators  (see  Figure  9).  To  achieve  this  BIT  capability,  the  following  elements  were  required  to 
perform  an  LRU  validation  and  to  isolate  malfunctions  to  an  SRU: 

•  Partitioning  of  functional  elements  to  a  unique  SRI' 

•  An  end-around  test  capability  of  f/O  channels 

•  There  should  be  no  signals  other  than  the  internal  bus  signals  and  pow»er  between  SRU’s 

•  The  CPU  is  essential  to  BIT  and  presents  the  initial  self-test  task 

•  The  Real  Time  Clock  timers  and  counters  must  be  both  loadable  and  readable  to  self-test  their  operation 

•  Power  supply  BIT  test  is  required 

•  There  must  be  a  method  to  test  and  verify  the  NO/GO  logic 

•  Indicators  must  be  provided  to  identify  the  failed  SRU. 

Ail  of  the  above  are  accomplished  in  the  F- 1 1 1  WNC. 

The  BIT  concept,  as  implemented  in  the  AN/AYK-18,  is  composed  of  three  major  elements:  Hardware  Error 
Detection  Circuits,  Software  Test  Routines  and  Microcode  Test  Routine. 

The  self-test  and  fault  isolation  routines  are  initiated  by  a  programmed  routine  or  upon  the  detection  of  a  NO-GO 
condition. 

The  first  step  in  the  self-test  routine  is  to  verify  that  the  CPU  is  functioning.  Since  the  CPU  is  divided  between 
two  SRU's,  the  microcontroller  SRU  must  be  given  the  kernel  capability  for  BIT  execution.  In  addition  to  BIT  microcode, 
it  is  desirable  to  have  local  macroinstruction  sequence  capability  for  BIT  so  that  independence  from  core  memory  is 
obtained  for  isolation. 

This  BIT  microcode  and  macrocode  may  be  used  to  test  the  arithmetic  SRU  of  the  CPU.  CPU  arithmetic  tests 
include  the  execution  of  instructions  and  validation  of  data.  Memory  tests  are  conducted  by  the  CPU.  These  tests 
include  sum  tests  and  verification  of  the  ability  to  read  and  write  into  areas  of  unprotected  memory. 

Each  MUX  SRU  is  practically  self-sufficient  with  respect  to  BIT.  MUX  self-test  has  been  incorporated  in  the 
existing  hardware  and  has  been  proven  to  be  very  effective.  In  addition  the  MUX  microcode  can  check  the  internal 
bus/memory  interface  redundantly  with  the  CPU  and  the  other  MUX  SRU. 

The  parallel  channels  and  discretes  are  tested  in  an  end-around  mode. 

Power  supply  self-check  includes  the  monitoring  of  the  four  dc  voltages  that  are  generated,  to  determine  whether 
they  are  within  specified  tolerances. 

Each  of  the  individual  SRU  BIT  detectors  is  summed  in  a  BIT  register.  The  CPU  monitors  this  register  and  may 
cause  a  self -test  procedure  to  be  initiated  when  a  BIT  error  is  detected.  The  CPU  or  the  MUX  microprocessor  may 


initiate  the  test,  depending  on  the  specific  failure.  If  the  failure  is  verified,  the  computer  NO-GO  is  generated  and  the 
specific  SR V  failure  is  identified  on  the  front  panel  coded  and  latched  failure  indicator.  Figure  9  is  a  photo  of  the  WNC 
front  panel,  showing  the  seven  electromechanical  BIT  indicators.  When  all  indicators  are  black,  system  operation  is 
normal.  A  decal,  mounted  directly  above  these  indicators,  informs  the  maintenance  man  how  to  interpret  the  indicators 
to  determine  whether  the  LRU  is  in  good  working  order,  or  which  5RU  of  the  LRU  is  at  fault.  Each  tune  the  power  is 
turned  on,  these  indicators  are  reset.  A  pushbutton  directly  below  the  displays  will  permit  the  maintenance  man  to  reset 
the  indicators,  assuming  power  is  on.  When  power  is  removed  from  the  LRU,  the  indicators  continue  to  hold  their  last 
setting  until  power  is  reapplied.  The  indicators  are  controlled  entirely  by  the  CPU’s  microcode  through  the  BIT  register 
and  in  no  way  by  the  software.  Thus,  memory  faults  leading  to  apparent  software  errors  cannot  cause  these  indicators  to 
be  set  incorrectly. 

As  a  result  of  this  unqiue  capability,  the  1-Level  SE  requirement  was  eliminated  -and  several  other  by-products 
accrued,  namely: 

•  The  skill  level  of  the  maintenance  personnel  was  reduced 

•  Turn-around  time  was  cut  in  half 

•  Unexplained  or  non-reproducible  failures  will  be  minimized. 

6.8  DESIGN  TOOLS 


A  discussion  of  the  design  techniques  for  modern  digital  electronics  would  be  incomplete  without  some  discussion 
of  Computer  Aided  Design  (CAD). 

6.8.1  CAD 

One  of  a  number  of  CAD  techniques  used  in  the  development  of  the  WNC  was  the  use  of  our  CRT-based  interactive 
graphics  system,  in  conjunction  with  a  computer  having  special  placement,  routing  and  verification  programs  to  design 
the  printed  wiring  boards.  This  system  is  used  to  accomplish  automatic  parts  placement  and  automatic  routing  of 
virtually  all  of  the  connections.  Once  completed,  the  result  is  edited  on  a  CRT  design  console  for  correctness  and  for 
conformance  with  preset  design  rules.  After  final  editing  a  paper  tape  is  prepared  for  subsequent  use  in  a  Slosyn  Film 
Generator  to  produce  the  PCB  artwork  and  for  the  numerically  controlled  PCB  drilling. 

In  addition  to  the  above,  a  Microsim  Simulator  is  another  form  of  CAD  used  in  the  design  of  the  AYK-18.  It  is  a 
four-state  logic  simulator  with  assignable  propagation  delays  which  is  used  for  design  verification.  It  is  also  utilized  for 
fault  simulation  to  determine  testability  of  digital  circuits. 

6.8.2  LABORATORY  SUPPORT  EQUIPMENT  (LSE) 

The  LSE  (see  Figure  10)  is  a  multi-usage,  user-oriented,  modular,  integrated  hardware/so/tware  computer  testing 
tool.  Kearfott  uses  variations  of  this  device  to  perform: 

•  Computer  SRU  (card  level)  testing  and  development 

•  LRU  (box  level)  testing 

•  Software  development  of  programs 

•  System  integration. 

The  LSE  is  a  computer  controlled  unit,  either  a  PDP-11-24  or  -34,  that  controls  the  operation  via  a  keyboard 
entry  and  supports  a  variety  of  user-selectable  operating  modes  that  include: 

•  Interaction  with  the  computer  during  program  execution.  This  includes  the  capability  to  examine  and  load 
memory  so  as  to  modify  programs  on-line. 

•  Monitoring  and  debugging  of  software  either  in  real-time  or  off-line. 

•  Loading  and  verification  of  programs  by  use  of  floppy  discs  which  are  an  integral  part  of  the  LSE. 

•  Programs  listing  on  a  line  printer. 

•  Comprehensive  diagnostic  procedures  to  separate  hardware  and  software  laults,  and  to  troubleshoot  hardware 
faults  in  the  computer  as  well  as  the  full  system  which  is  controlled  by  the  computer  via  ifs  I/O. 

•  Unlimited  break  point  capability. 

•  Performance  measurements  on  the  computer. 

The  data  logging  capability  includes  the  ability  to  store  the  last  2000  instructions  that  were  executed  and  print  out 
the  data  on  hard  copy.  Units  that  are  delivered  for  operation  at  Air  Force  maintenance  depots  are  militarized  versions 
of  the  LSE. 

6.9  STATUS 


The  F-1U  WNC  contract  was  awarded  to  Kearfott  on  15  September  1981.  This  is  a  multi-year  contract  for  525 
computers,  support  software,  LSE,  Data  and  AGE  equipment. 

The  first  computer  delivery,  a  brassboard  with  its  LSE,  was  made  three  months  ARC,  1-1/2  months  ahead  of 
contract  schedule.  The  first  two  preproduction  computers  were  delivered  7-1/2  months  ARO.  To  date  (30  August  1982), 
six  preproduction  computers  and  six  LSE  units  plus  data  have  been  delivered. 

The  U.5.  Air  Force  has  validated  flight  software  with  the  new  computers  and  flight  testing  commenced  in 
September  1982. 


7.  GROWTH  CAPABILITY 

The  AN/AYK-18  architecture  has  built-in  growth  capability  in  a  number  of  areas  without  major  redesign.  It  has  a 
high  degree  of  functional  and  physical  modularity  which  permits  upgrading  individual  modules  (cards)  without  changing 
architecture,  internal  electrical  interfaces  or  mechanical  design  as  new  memories,  1C  and  VLSI  devices  become 
available.  This  growth  potential  is  facilitated  by  the  use  of  a  standardized  high  speed  parallel  bus  to  interconnect  the 
various  modules. 
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7.1  MEMORY 


The  CPU  has  an  addressing  and  memory  management  growth  capability  range  of  1,048  K  words,  and  thus  can  handle 
larger  size  memories.  The  present  magnetic  core  memory  modules  can  be  directly  replaced  by  double  density  magneti- 
core  modules  to  increase  capacity  from  64  K  to  128  K  words  with  the  same  module  dimensions. 

In  addition  to  core  memories,  the  variety  of  solid  state  memory  devices  available  also  offers  substantial 
performance  trade-offs  and  improvement,  including  increased  speed,  lower  power  (CMOS  RAM's)  and  greater  density, 
although  not  at  the  same  time.  Solid  state  RAM  memory  can  be  combined  with  core  to  provide  higher  speed  scratch  pad 
memory  while  retaining  core  for  program  storage. 

If  a  mass  memory  is  considered  such  as  disk  or  bubble  memory,  a  high  speed  RAM  can  then  be  introduced  for  all  of 
main  memory  to  increase  execut.on  speed.  The  combination  of  UVEPROM  or  bi-polar  PROM/ROM  for  program  storage 
and  RAM  for  data  can  be  considered  for  applications  in  which  program  changes  are  unlikely. 

7.2  CPU 

CPU  performance  can  be  upgraded  in  several  ways.  The  logic  is  capable  of  running  at  an  increased  clock  rate  to 
directly  speed  up  execution.  An  instruction  look-ahead  cache  memory  can  be  incorporated  to  provide  a  queue  of 
instructions  which  eliminates  instruction  fetch  times  as  a  contribution  to  execution  times,  particularly  with  core 
memories. 

7.3  I/O  GROWTH 


A  high  degree  of  I/O  customizing  to  application  requirements  is  feasible  without  affecting  overall  architecture. 
Individual  I/O  modules  can  be  configured  as  "Smart"  processors  to  further  minimize  CPU  time  loading.  Standard  I/O 
modules  are  available,  e.g.,  MIL-STD-1553  Dual  Bus  Controller,  parallel  DMA  channels,  etc.,  to  accommodate  this 
expansion  capability. 


8.  CONCLUSION 

By  the  optimum  utilization  of  digital  signal  processing,  computer  architecture,  and  mechanical  trade-offs,  strict 
adherence  (from  inception)  to  design-to-cost  methodology,  and  the  utilization  of  modern  CAD  techniques,  the  dual  ISA 
Computer  described  has  fully  achieved  its  performance  and  LCC  goals. 

The  computer,  to  quote  a  recent  Air  Force  report,  will  have  approximately  four  times  the  memory,  five  times  the 
reliability,  and  twice  the  speed  at  one  half  the  cost  of  the  original.1 
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Summary 

This  paper  describes  an  interlocking  set  of  techniques  covering  control  law  and  control  system 
architecture  design,  docvnentation  and  validation.  These  address  the  problems  experienced  by  the  airframe 
manufacturer  in  proving  the  integrity  of  a  digital  control  system  (hardware  and  software)  in  such  a  way 
that  the  undoubted  power  and  flexibility  of  digital  techniques  can  be  fully  exploited.  An  idealised 
processor  architecture  and  instruction  set  is  presented  and  its  application  illustrated  by  reference  to  a 
set  of  non  linear  control  laws.  This  shows  how  the  control  law  coding  and  verification  can  be  eliminated 
as  a  separate  step  in  the  design  process.  Finally  the  beneficial  effect  of  the  control  law  structure  on 
the  process  of  failure  identification  and  subsequent  failure  management  is  described. 


I .  Introduction 


Flight  control  systems  are  required  by  modern  combat  aircraft  to  provide  acceptable  response 
characterist ics  for  a  wide  range  of  flight  conditions  and  tasks.  In  recent  years,  the  rapid  development 
of  digital  control  techniques  has  provided  the  means  of  fulfilling  such  requirements,  not  only  through  the 
greator  sophistication  that  these  allow,  but  also  through  implementation  advantages  of  reduced  noise 
problems,  Improved  self-test  capability,  function  modification  by  reprogramming  and  an  inherent  function 
repeatability  from  one  unit  to  the  next.  As  experience  with  this  type  of  system  has  accumulated,  it  has 
become  clear  that  advances  in  software  production  techniques  have  not  kept  pace  with  advances  in  hardware. 
In  particular,  there  are  problems  in  quantifying  the  integrity,  and  this  has  left  the  problem  of  common 
mode  software  failures  unresolved. 

The  principal  problem  of  ensuring  safe  software  is  related  to  maintaining  visibility  of  the 
algorithms.  This  requires  Identifiable  logic  paths  and  partitioning  of  control  laws  into  functional 
blocks.  Attempts  to  Improve  visibility  include  the  use  of  high  level  languages  in  which  logic  paths  can 
be  easily  checked,  but  this  shifts  the  problem  of  ensuring  safe  software  since  it  is  now  the  compiler 
integrity  that  must  be  resolved,  an  equally  if  not  more  difficult  task. 

Ensuring  safe  software  is  time  consunlng,  and  costly.  If  the  control  program  is  contained  in  a 
single  processor,  any  modification  to  part  of  the  control  algorithms  will  result  in  the  need  to  reverify 
the  whole  software  package.  Use  of  a  distributed  processor  system,  in  which  control  algorithms  are 
physically  partloned,  alleviates  the  situation  but  the  need  for  high  rates  of  throughput  limits  the  degree 
of  partitioning  if  the  processors  are  connected  by  a  data  bus. 

The  ramifications  of  the  problem  are  widely  felt.  Experimental  research  aircraft,  development 
flying  of  prototype  aircraft  or  variations  in  production  aircraft  to  meet  different  customer 
specifications,  all  currently  need  substantial  effort  to  verify  control  law  software.  Failure  to 
alleviate  the  situation  places  constraints  on  the  range  of  applications  of  active  control,  and  detracts 
from  its  use  as  a  cost  effective  method  of  improving  pilot  in  the  loop  efficiency. 

This  paper  describes  an  approach  to  this  problem.  It  is  directed  towards  the  use  of  asynchronous 
processors  which  are  programed  through  a  limited  but  highly  flexible  instruction  set.  The  system 
architecture  is  appropriate  to  complete  functional  partitioning  of  the  control  algorithms  and  has 
implications  on  the  complexity  (and  hence  integrity)  of  flight  control  computer  performance  monitors.  The 
approach  described  eliminates  the  need  to  treat  coding  of  flight  control  algorithms  as  a  separate  phase, 
since  the  code  is  developed  as  an  Integral  part  of  any  non-real  time  simulation  undertaken  by  the  system 
designers.  The  docunentstion  of  the  resulting  code  is  essentially  diagramatlc  and  hence  very  concise  and 
easily  understandable,  particularly  since  it  uses  conventions  which  would  be  familiar  to  most  engineers. 

2.  A  Simple  Safe  Software  System 

This  approach  uses  an  assumed  common  characteristic  of  all  control  tasks  in  order  to  achieve  simple 
specification,  doctnentatlon  and  code. 

All  control  algorithms  can  be  represented  as  a  continuous  signal  flow  diagram  which  can  be 
decomposed  into  a  small  number  of  component  elements;  viz  Add,  Subtract,  Load,  conditional  load.  Multiply, 
Divide,  Look-up,  Integrate,  etc.  Flg.l  shows  the  original  Laplace  transform  specif lcation  of  a  control 
function  and  Fig. 2  Illustrates  a  corresponding  pseudo-analogue  representation.  It  is  this  diagram  which 
forms  the  basis  for  subsequent  simulation  and  coding.  Fig. 3  gives  the  decomposition  of  this  into  a 
specification  file  using  an  idealised  instruction  set. 

The  use  of  the  pseudo- analogue  diagram  (Pig. 2)  allows  explicit  diagrammatic  representation  of  all 
intermediate  points  in  the  calculation,  and  this  clearly  identifies  possible  scaling  problems.  It  is  a 
very  convenient  and  rigorous  program  specification  document  requiring  very  few  types  of  instruction  to 
completely  describe  its  operation  (say  16  compared  with  128  for  common  microprocessors) .  This  eases  the 
task  of  proving  the  correct  operation  of  those  instructions  in  hardware.  It  also  minimises  the  effort 
involved  in  learning  to  use,  or  check  the  use  of,  the  Instruction  set. 
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The  instruction  set  is  limited  to  that  set  of  operations  which  have  a  one  to  one  equivalence  with  a 
feature  in  the  pseudo  analogue  diagram,  so  the  set  can  grow,  bu*-  not  in  any  way  which  would  detract  from 
the  inherent  simplicity  of  specif ication  and  documentation.  See  Table  l  for  the  present  suggested 
instruction  set. 

This  idealised  instruction  set  can  now  be  used  in  one  of  two  ways.  It  can  be  used  as  a 
specification  language  with  a  translation  team  or  program  used  to  convert  the  code  to  target  machine  code, 
together  with  the  incorporation  of  whatever  timing  and  synchronisation  is  necessary.  (A  good  example  of 
this  approach  is  LUCOL  $  Ref  1).  Alternatively,  since  the  idealised  Instruction  set  is  so  small  and  simple 
it  can  be  executed  directly  by  a  suitable  processor.  This  is  of  considerable  benefit  when  it  cones  to 
proving  the  integrity  of  the  code  implemented  on  the  machine  since  a  translator  approaci.  will  considerably 
expand  and  complicate  this  final  code. 

If  the  target  processor  is  fast  enough  to  execute  all  program  statements  every  program  pass,  the 
need  for  separate  executive  functions  within  the  program  is  removed.  If  the  program  iteration  rate  can 
then  be  made  sufficiently  fast,  further  simplifications  are  possible  since  the  digital  implementation  of 
the  control  function  can  be  considered  as  continuous.  This  removes  the  need  to  consider  any  timing  or 
synchronization  problems  other  than  those  implicit  in  the  control  function  being  executed,  and  also 
simplifies  the  control  function  design  stage  by  eliminating  the  need  to  perform  a  Z  transform  analysis. 

3.  Hardware  Implications 

Software  is  becoming  relatively  more  important  than  hatdware  in  determining  the  costs  of  ownership 
of  many  digital  systems.  Therefore  for  this  class  of  system  it  may  become  advantageous  to  trade  off  an 
increase  in  processor  speed  for  a  reduction  in  software  complexity.  (See  Fig. 4) 

For  any  particular  application  the  Safe  Software  System  described  above  would  require  an  Increase  in 
processor  speed  of  approximately  two  orders  of  magnitude  when  compared  with  a  more  conventional  approach. 
When  considered  in  conjunction  with  the  fact  that  the  function  being  executed  will  naturally  become  ever 
more  complicated*,  then  this  approach  presents  a  formidable  hardware  requirement. 

This  processing  speed  requirement  will  be  at  least  partially  met  by  increasingly  dense  integrated 
circuit  techniques,  such  as  those  being  developed  in  the  USA's  VHSIC  (Very  High  Speed  Integrated  Circuit) 
or  the  UK’s  VHPIC  (Very  High  Performance  Integrated  Circuit)  programmes. 

In  addition  the  use  of  a  multiprocessor  configuration  ensures  that  sufficient  processing  power  is 
available  as  well  as  allowing  the  control  task  to  be  partitioned  into  convenient  modules.  The 
communication  between  modules  is  now  important  since  if  the  Safe  Software  benefits  outlined  above  are  not 
to  be  lost  then  the  interface  between  processors  must  be  rigorously  controlled.  The  standard  multi 
processor  communication  techniques  of  shared  memory  or  common  data  bus  would  restrict  either  the  number  of 
processors  which  could  be  linked  or  the  rate  at  which  data  could  be  exchanged  or  both.  Also  In  the  event 
of  faulty  operation  of  one  processor  either  through  a  hardware  fault  or  program  error.  It  would  be 
difficult  to  predict  the  effect  on  the  other  processors.  If  a  network  approach  is  adopted  with  one 
variable  being  transmitted  per  physical  link  in  a  continuous  manner,  the  number  of  processors  can  be 
extended  indefinitely  and  no  handshake  routines  or  protocols  are  needed.  Tne  propagation  of  failures 
between  processors  is  entirely  predictable  and  the  interface  between  processors  can  be  rigorously 
controlled  by  a  single  patching  function  which  can  use  standard  analogue  drawing  and  inspection  techniques 
for  design,  documentation,  and  change  control.  (Ref  2  describes  early  development  of  these  asynchronous 
multiprocessor  concepts) 

An  idealised  processor  module  specification  has  been  suggested  based  on  our  experience  with  hardware 
concept  proving  exercises  (See  Table  2).  The  interfacing  and  instruction  set  is  as  outlined  above  with 
all  input/output  memor  •  mapped  and  the  maximum  program  size  determined  empirically  from  the  size  of 
functional  design  tas  htch  would  normally  be  allocated  to  a  single  individual.  All  data  storage  is 
assumed  to  be  of  the  t..une  type,  32  bit  real.  This  outline  hardware  specification  has  been  derived  from 
the  requirement  to  operate  high  integrity  control  systems  with  no  reference  to  the  limitations  of  current 
technology.  As  such  it  could  alleviate  a  number  of  hardware  support  problems.  In  particular  it  would 
insulate  the  system  designer  and  system  owner  from  changes  in  technology  since  the  benefits  in  terms  of 
reduced  module  cost,  size,  weight,  power  requirement  or  improved  EMI  performance  could  be  capitalised  on 
without  changing  the  essential  fora  and  fit  of  the  processor  module. 

The  highly  modular  nature  of  this  type  of  processor  and  the  ease  with  which  it  can  be  configured  to 
a  wide  range  of  control  requirements  would  also  lead  to  what  would  b*. ,  In  military  terms,  a  relatively 
large  volime  application  and  this  would  justify  the  highest  levels  of  Integration. 

4.  Program  development 

One  of  the  major  benefits  anticipated  from  the  adoption  of  a  Saf'-  7  >ftware  System  such  as  that 
described  above  is  that  the  control  system  design  engineers  generate  their  own  code.  The  software 
development  procedures  therefore  become  an  integral  part  of  the  control  design,  simulation  and  validation 
procedures. 

In  particular  the  simulation  language  TSIM  developed  by  the  RAE  at  Farnborough  (see  ref  3)  Is  used 
to  optimise  a  control  system  design,  taking  into  account  the  non  linearities  boeh  within  the  controlled, 
and  the  control  system. 

*  Plight  control  functions  are  becoming  more  comprehensive  and  complicated  as  task  oriented  control  and 
carefree  manoeuvering  modes  are  more  fully  exploited. 


$  LUCOL  is  a  registered  trade  mark  of  Lucas  Industries  Ltd. 
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.he  simulation  of  the  control  system  using  this  software  package  is  documented  within  BAe  using  a 
pseudo-analogue  diagram  identical  to  that  already  described. 

Normally  the  code  to  implement  this  function  is  written  in  a  specification  language  which  Is  then 
translated  Into  a  Fortran  program  for  subsequent  compilation  and  execution.  It  would  only  be  a  small  step 
to  make  the  TS1H  specification  language  used  for  the  simulation  of  the  control  program  Identical  to  the 
Idealised  Instruction  set  already  described.  Thus  the  development  of  the  function  and  the  proof  of  Its 
correct  operation  would  inherently  develop  the  target  machine  code  and  prove  its  correct  operation.  The 
resulting  code  from  the  final  approved  control  design  would  only  then  require  a  very  simple  assembler  and 
down  loading  operation.  Change  control  on  this  software  development  system  would  be  based  on  the 
established  procedure  of  automatically  updating  the  version  number  of  a  file  after  any  edit. 

5.  Application  to  control  algorithm  design 

In  respect  of  control  system  design  the  most  attractive  aspect  of  the  sof tw* re/ hardware  concept 
described  above  Is  that  the  control  algorithms  may  be  easily  physically  partloned  into  functional  blocks. 
This  Is  a  more  cost  effective  method  of  introducing  additional  control  algorithm  options  since 
Implementation  will  not  affect  already  existing  proven  controllers.  Different  control  algorithms  may  be 
switched  in  manually  through  some  pilot  selectable  cockpit  switch  (eg  in  the  case  of  task  oriented 
control),  or  automatically  through  some  prespecified  switching  criteria.  The  latter  approach  may  be  used 
to  yield  a  class  of  non  linear  control  laws  which  revolve  around  switching  between  essentially  linear 
sub-controllers  (see  Fig. 5).  This  has  the  attraction  that  the  design  rules  and  stability  criteria  for 
each  sub-controller  are  well  established,  and  the  non  linear  control  problem  is  reduced  to  one  of 
determining  the  piloting  and  stability  Implications  of  the  switching  action.  An  additional  attribute  is 
that  in  partitioning  control  laws  In  this  manner,  the  designer  does  not  have  to  compromise  designs  of 
controllers  for  different  tasks. 

Examples  are  provided  below  for  two  aspects  of  a  fighter  aircraft  longitudinal  control.  Firstly,  a 
pitch  rate  manoeuvre  demand  system  which  switches  to  an  Incidence  demand  system  at  high  angles  of  attack. 
This  provides  the  pilot  with  good  control  when  at  the  edge  of  a  manoeuvre  boundary  without  sacrificing 
control  characteristics  in  normal  operation.  The  second  example  demonstrates  a  pitch  rate  manoeuvre 
demand  system  In  which  the  response  bandwidth  varies  with  amplitude  of  error  signal.  This  provides  a 
means  of  achieving  rapid  response  to  pilot  demand  without  compromising  the  need  for  noise  rejection. 

5.1  Angle  of  attack  limiting 

Angle  of  attack  limiting  has  long  been  recognised  as  an  Important  part  of  a  carefree  manoeuvring 
system  in  which  the  pilot  does  not  have  to  continually  monitor  the  state  of  the  aircraft  in  order  that  it 
does  not  enter  an  unstable  portion  of  the  flight  envelope.  In  this  approach  to  designing  such  a  system 
(based  on  an  extension  to  those  described  in  Ref  4),  the  control  laws  are  partloned  into  two,  i  pitch  rate 
manoeuvre  demand  controller  and  an  angle  of  attack  demand  system.  The  two  controllers  are  then  modified 
so  that,  with  the  switching  algorithm  included,  the  overall  system  takes  the  form  shown  in  fig  1,  in  which 
measures  of  pilot  demand  are  input  to  each  loop.  The  elevator  actuator  demand  is  then  derived  from  the 
more  nose  down  signal  from  either  of  the  two  controllers.  In  normal  operation,  the  angle  of  attack 
controller  demands  an  incidence  higher  than  that  demanded  by  the  pitch  rate  controller,  and  thus  the 
latter  loop  remains  engaged.  As  the  angle  of  attack  increases  towards  the  boundary,  the  angle  of  attack 
controller  takes  over,  with  the  maximum  angle  of  attack  achieved  when  the  pilot  stick  is  fully  aft. 

This  system  was  applied  to  the  mathematical  model  of  the  RAE  fly-by-wire  Hunter  (See  Ref  5).  The 
9y9tem  performance  has  been  demonstrated  In  both  off-line  studies  and  in  piloted  simulation  and  has 
received  favourable  pilot  cotaner  '..  An  example  of  the  response  is  shown  in  fig  6.  Fig,  7  illustrates  the 
Btick  versus  angle  of  attack  relationship  produced  by  this  system. 

As  an  extension  to  such  a  system,  the  relationships  between  demanded  angle  of  attack  and  stick 
position  could  be  varied  with  forward  speed,  and  used  as  a  method  of  blending  response  modes  (Ref  8).  For 
example  if  an  angle  of  attack  controller  were  deemed  appropriate  for  the  landing  phase,  it  would  only  be 
necessary  to  vary  the  relationship  between  stick  position  and  angle  of  attack  demand  with  forward  speed  in 
order  to  effectively  disengage  the  pitch  rate  controller. 

5.2  Non-linear  pitch  rate  manoeuvre  demand  system 

One  of  the  problems  in  control  system  design  is  the  need  to  generate  a  high  gain  control  system  with 
rapid  removal  of  any  closed  loop  steady  state  errors  whilst  preserving  adequate  noise  rejection.  These 
requirements  are  in  conflict  and  have.  In  the  past,  compromised  control  system  design.  To  resolve  this 
conflict,  recent  work  has  been  aimed  at  varying  system  bandwidth  so  that  for  small  closed  loop  error 
signals,  a  narrow  bandwidth  exists  (thus  fulfilling  noise  rejection  criteria),  whilst,  In  response  to 
pilot  demand,  the  bandwidth  increases  temporarily  to  provide  a  rapid  response.  (See  Ref  6) 

The  switched  linear  system  approach  to  resolving  the  conflict  in  design  criteria  is  based  on  a 
number  of  pitch  rate  manoeuvre  demand  loops  of  progressively  increasing  loop  gain/bandwidth.  The 
individual  loops  are  linked  together  as  shown  in  Fig. 8.  Taking  a  linearised  aircraft  model  the  responses 
of  the  individual  loops  to  pitch  rate  gyro  noise  are  shown  in  Fig. 9.  As  seen  in  Fig. 10,  although  the 
bandwidth/ loop  gain  changes  are  discrete,  there  appears  to  be  a  ’pseudo  continuous’  change  in  degree  of 
sensor  noise  reaching  the  actuator  as  the  closed  loop  error  signal  reduces  to  zero.  Effects  of  dominant 
aircraft  parameter  changes  are  shown  in  Figs. 11  and  12, 
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6 .  Performance  monitoring 

The  partitioning  of  the  control  laws  in  the  manner  described  above  provides  a  more  appropriate 
system  architecture  for  the  use  of  flight  control  computer  performance  monitors.  Monitors  dedicated  to 
specific  controller  functions  may  be  Included,  and  in  view  of  their  resultant  simplicity,  their  integrity 
may  be  more  easily  quantified.  Simple  algorithms  can  be  derived  on  the  basis  of  generation  and 
cross-comparison  of  band-limited  signals  from  dissimilar  sources,  and  their  algorithms  can  be  designed  for 
one  controller  with  only  limited  change  required  if  any  gain  scheduling  exists  in  the  control  algorlttus. 
(See  Ref  7) 

7 .  Current  applications 

The  work  described  in  this  note  was  developed  in  the  course  of  the  joint  BAR/RAE  Farnborough  control 
laws  research  program  on  the  FBW  Hunter.  This  was  prematurely  curtailed  by  the  recent  loss  of  the 
aircraft  following  engine  failure  on  take  off. 

It  1  now  intended  to  continue  this  work  using  rig  studies  pending  the  location  of  a  suitable  flight 
vehicle  to  replace  the  Hunter.  These  rig  studies  will  give  the  opportunity  to  develop  a  system 
engineered  in  a  manner  representative  of  future  project  aircraft,  and  to  investigate  the  most  appropriate 
level  of  integration  with  other  avionics  equipment  connected  by  the  1553  data  bus. 

8.  Final  Comments 


A  complementary  set  of  design  techniques  have  been  developed  which  attain  high  confidence  In  their 
operating  techniques  through  reliance  on  simple  established  good  practice  within  a  module.  The 
sophistication  and  power  of  the  control  action  is  then  achieved  by  suitable  linking  of  modules.  The  two 
techniques  described  in  this  paper  of  "switched  linear  control"  and  "asynchronous  multiprocessor"  show  how 
this  linking  can  be  achieved  with  a  minimum  of  additional  problems.  This  approach  is  Ideally  suited  to 
the  use  of  dissimilar  redundancy  both  in  the  control  law  design  and  its  implementation  and  could  well  be 
extended  to  a  gracefully  degrading  system  configuration  due  to  the  ease  with  which  failure  propagation 
through  the  system  can  be  analysed. 

The  original  Intent  of  this  work  was  to  ease  the  task  of  developing  and  proving  high  integrity 
systems,  but  as  experience  has  acciauulated ,  various  potential  hardware  and  logistic  support  benefits  have 
become  apparent. 

These  techniques  hav«  been  implemented  to  date  using  commercial ly  available  processors,  and  their 
application  has  been  considered  only  In  the  context  of  inner  loop  control  tasks  where  the  speed  and 
integrity  requirements  are  at  their  most  severe.  A  more  representative  engineering  implementation  and 
application  to  a  wider  range  of  control  tasks  are  now  being  investigated  both  within  BAe  and  in  the 
Avionics  industry  principally  at  Lucas  Aerospace.  If  successful  this  work  could  allow  the  considerable 
benefits  of  active  control  to  be  applied  to  a  wider  range  of  aircraft  types  both  by  reducing  the  non 
recurring  system  design  and  verification  task,  and  by  reducing  the  recurring  system  costs  of  hardware 
provision  and  support. 
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Table  2:-  Idealised  processor  module  Hardware  Specification 
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Summary 

An  investigation  was  made  of  the  application  of  robust  output  observer  theory  to  the  design  of  flight 
control  systems  for  advanced  aircraft  configurations.  Observer  theory  constitutes  a  natural  design  tool 
because  the  resulting  observers  are  in  themselves  unobservable  and  do  not  increase  the  order  of  the  closed- 
loop  response,  thereby  more  closely  satisfying  flying  qualities  requirements.  Examples  are  presented 
to  show  that  the  observer  configuration  is  not  unique  in  either  the  observer  poles  or  the  output  sensors, 
and  many  different  control  system  configurations  using  a  variety  of  sensors  can  be  designed  to  yield  iden¬ 
tical  closed-loop  dynamic  behavior.  In  this  way,  considerable  analytic  and  physical  redundancy  can  be 
incorporated  into  nearly  any  flight  control  system. 

Introduction 


Advanced  control  concepts  for  aircraft  almost  always  involve  new  ways  of  generating  forces  and  moments 
on  the  vehicle,  thereby  implying  a  potential  for  enhanced  maneuverability  and  precision  of  flight  with  aug¬ 
mented  performance  through  weight  and  drag  reduction.  Conventional  control  system  design  theory  is  not 
reallv  adequate  for  multicontroller  flight  control  system  design  so  the  tendency  is  towards  the  use  of  the 
more  modem  control  theories,  such  as  optimal  control,  that  can  conceptually  generate  acceptable  designs 
quickly  and  efficiently. 

The  systems  that  result  from  the  application  of  modern  control  theory  are  generally  complex,  requiring 
feedback  from  each  of  the  states  to  all  of  the  controllers.  In  an  attempt  to  avoid  or  sidestep  the  require¬ 
ment  that  all  states  be  measured,  state  estimator  or  observer  systems  have  been  devised  in  an  attempt  to 
reduce  the  number  of  required  sensors  or  to  improve  the  accuracy  of  the  state  measurements.  This  has  led 
to  a  totally  new  crop  of  problems,  including  reduced  robustness  through  reduction  of  gain  and  phase  margins 
as  compared  to  state  feedback  systems,  inability  to  guarantee  stability  and  a  closed-loop  system  character¬ 
ized  by  response  delays  and  lags  that  almost  always  degrade  the  flying  qualities  of  the  vehicle  itself. 

This  paper  describes  the  theory  and  presents  applications  of  robust  output  observers.  The  motivation 
for  this  research  stems  from  a  desire  to  reduce  the  number  of  sensors  required  to  implement  a  multivari¬ 
able  system  control  law  without  reducing  the  robustness  of  the  system  as  compared  to  state  feedback.  It 
is  based  upon  the  accurate  premise  that  most  sensors  .used  in  flight  control  system  design,  such  as  rate 
and  attitude  gyros,  linear  accelerometers  and  even  angle  of  attack  sensors  are  essentially  noise-free  in 
themselves . 

Critical  to  the  design  of  an  observer  system  is  the  selection  of  the  observer  poles.  As  shown  below, 
proper  selection  of  these  poles  can  lead  to  the  achievement  of  a  number  of  desirable  control  system  prop¬ 
erties,  including: 

m  Synthesis  of  the  optimal  system  with  fewer  sensor*  than  states. 

•  Preservation  of  the  robustness  of  the  system  as  defined  by  state  feedback. 

•  Elimination  of  the  higher  order  response  lags  that  degrade  flying  qualities  associated  with  most 
estimator  systems. 

•  Elimination,  in  many  cases,  of  the  need  to  measure  the  inputs  or  control  surface  deflections  of  the 
vehicle . 

•  Enhancement  of  system  observability  as  measured  by  decreased  feedback  gains  required  to  achieve  a 
particular  closed-loop  dynamic  response. 

Observer  Theory 

The  original  observer  theory  by  Luenberger1  was  developed  as  a  state  reconstruction  technique,  in  which 
the  output  of  the  observer  system  approached,  as  time  increased,  the  state  that  is  to  be  reconstructed. 

The  theory  developed  by  Luenberger  described  deterministic  observers  which  are  in  themselves  unobservable 
and  do  not  contribute  to  an  increase  in  the  order  of  the  response  of  the  system.  In  general,  the  poles 
of  the  observer  can  be  chosen  arbitrarily,  but  this  choice  generally  results  in  a  requirement  that  the 
control  input  to  the  aircraft  also  is  a  control  input  to  the  observer  system.  A  recognition  of  the  inter¬ 
actions  involved  in  observer  design  can  result  in  considerable  observer  design  simplifications.  This 
paper  explores  and  defines  some  of  the  freedom  allowed  the  designer  in  deterministic  observer  choices  that 
can  result  in  simplified  systems  that  still  meet  the  objectives  of  the  flight  control  system. 

Consider  the  linearized,  small  perturbation  equations  of  vehicle  motion 

x  =  Fx  +  Gu  (1) 

y  *  Hx 

where  x  is  the  state  vector,  u  the  control  input  vector  and  y  the  output  vector,  the  measurement  set  such 
as  a  pitch  rate  gyro  and  accelerometer  sensor.  The  observer  is  of  the  form 


a  »  48  •f  By  Du 
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subject  to  the  conditions: 

1.  The  matrix  A  i>  chosen  such  that  the  observer  is  stable. 

2.  A  transformat ion  T  can  be  found  such  that  TF-A?  a  BH. 


i 


where  F ,  G  and  :!  are  defined  above. 

A  robust  output  observer  must  satisfy,  in  addition  to  the  above  conditions: 

4.  The  observer  poles .  defined  from  \le-A |  -  0  are  chosen  from  the  transmission  zeros  of  the  system,  de¬ 
fined  by  \H(Ib-F )~*G\  *  0 ,  i.e.  when  the  number  of  sensors  equals  the  number  of  controllers. 

5  .  r G  a  D  *  0 . 


A.  The  matrices  H  and  T  constitute  a  transformation  y 


such  that  the  equivalent  output  and  observer  control  law  is  given  by 


(4) 


The  condition  that  ?G  =  D  *  3  is  automatically  satisfied  if  the  observer  poles  are  chosen  from  among 
the  system  transmission  zeros.  Not  only  does  this  simplify  the  observer  network  but  also  reduces  the  num 
ber  of  required  measurements  of  the  vehicle  dynamics. 


Example  1 

Observers  can  often  be  used  to  enhance  the  observability  of  the  system  in  the  sense  that  much  lower 
feedback  gains  are  often  required  to  obtain  the  same  closed-loop  dynamic  behavior  as  compared  to  state 
feedback.  This  comes  about  because  the  feedback  through  the  observers  is  shaped  as  a  function  of  frequency 
and  this  can  often  be  used  to  the  advantage  of  the  designer.  Consider  the  system 


2  -1 

6  -12 

€■  -11 


(5) 


with  a  single  measurement  y  *  Xj  -  2x0  + 

If  it  is  assumed  that  it  is  for  some  reason  desirable  to  alter  the  open-loop  characteristic  polynomial 
0(8}  =  j/s-fl  =  ^  +  ‘r>97  +  £>8  +  ?.  to  a  closed- loop  characteristic  polynomial  \'e)  =  1  Iq-F+-GK\  -  s*  +  + 

Fs  +  7,  then  the  state  feedback  control  law  is  given  by 


-.4  *  -  6x , 


(b) 


According  to  condition  (4),  the  poles  of  the  observers  can  be  chosen  from  among  the  system  transmission 
zeros  which,  for  this  example,  are  the  zeros  of  the  transfer  function 


y/u(e)  - 


8  +68+6 
^+582+S8+2 


(s+2)  (6+4) 


(7) 


{ 

i 


This  output  transfer  function  represents  a  minimum  phase,  completely  observable  measurement  so  two  out¬ 
put  observers  can  be  constructed  with  observer  poles  equal  to  the  zeros  of  the  output  transfer  function; 
i.e.  s,  =  -2,  =  -4.  The  observers  can  then  be  chosen  automatically  as 

‘Z1  =  ~4zl  +  #  (8) 

z «  -  +  y 

The  matrix  M  of  condition  (6)  listed  above  and  the  control  law  is  roost  easily  obtained  by  first  trans¬ 
forming  into  the  phase  variabte  form 

"  "  FoU  +  Gou  C9) 

x  ~  Nv 
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The  transformation  Mx  can  then  be  determined  as  follows2: 

a)  The  elements  of  the  first  row  of  the  matrix  M  are  made  up  of  the  coefficients  of  the  numerator  polyno¬ 
mial  of  the  output  transfer  function,  i.e. 


m:  =  [8  6  1] 

b)  Hie  second  row  of  the  matrix  is  made  up  from  the  coefficients  that  result  when  e+4  has  been  factored  out 
of  the  numerator  polynomial  of  the  output  transfer  function,  i.e. 


msls)  = 


a*+6e+8 

8+4 


8+2 


so 


mz  *  [2  1  0) 

c)  Similarly,  the  third  row  is  formed  from  the  coefficients  that  result  when  the  factor  8+2  has  been  fac¬ 
tored  out  of  the  numerator  polynomial 


ms(8) 


.  s+4 


so 


m*  -  [4  1  0] 

This  process  is  exactly  the  same  as  defining  the  matrix  V  in  the  equation 

TF  -  AT  =  BH 

when  F  and  H  are  defined  in  the  phase  variable  form. 

The  observer  control  law  is  then  given  by 


u 


3 

2  3 2 


(H) 


and  the  closed-loop  system  is  shown  in  Figure  1.  The  system  shown  in  Figure  1  has  the  same  robustness  or 
gain  and  phnse  margins  as  the  state  feedback  system,  but  the  system  employing  observers  uses  only  one  out¬ 
put  or  sensor,  the  feedback  gains  are  much  lower  and  the  observers  constitute  low  pass  filters,  useful 
for  structural  mode  stabilization  or  noise  suppression. 


Multivariable  System 

In  the  previous  section,  it  was  shown  that  if  the  observer  poles  were  chosen  from  among  the  zeros  of 
the  transfer  functions,  no  plant  input  measurements  were  required  in  the  observer  synthesis  for  systems 
that  were  completely  observable.  For  multi-controller  systems,  exactly  the  same  principle  holds  except 
that  the  observer  poles  are  chosen  from  the  transmission  zeros  of  the  system  defined  as  the  roots  of  the 
polynomials 

\H(Ie-P)~1G\  =  0  (12) 


when  the  system  is  defined  by  the  standard  equations  of  motion 

x(t)  ‘  Fx(t)  +  Gut t) 
y(t)  =  Hx(t) 

ks  indicated  by  Equation  (12),  the  transmission  zeros  are  a  function  of  the  sensors  or  outputs  as  well 
as  the  controller  inputs.  In  general,  a  robust  output  observer  can  be  obtained  if  the  system  is  complete¬ 
ly  controllable  and  observable  with  the  chosen  sensors  and  if  the  number  of  non-minimum  phase  transmission 
zeros  is  equal  to  n-m,  where  m  is  the  number  of  sensors  used.  For  an  nth  order  system  with  m  independent 
output  measurements  and  p  independent  inputs,  the  maximum  number  of  transmission  zeros  is  given  by 

"  -  (n-r>  0,1 

Ordinarily,  the  number  of  transmission  zeros  exceeds  the  number  of  observers  to  be  constructed  so  there  is 
design  freedom,  as  shown  by  the  following  example. 

Consider  the  4th  order  system  given  by 
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According  to  Equation  fl3),  the  maximum  number  of  transmission  zeros  of  this  system  is 


•v  -  <*-*>  [tS^TTpJ  !4-2>  [irir]- 


as) 


A  maximum  of  two  of  a  possible  six  transmission  zeros  must  be  minimum  phase  in  order  to  be  able  to  con¬ 
struct  a  stable  output  observer  system.  There  are  three  sets  of  transmission  zeros  that  can  be  used  in  the 
selection  of  the  output  observer  poles.  These  three  sets  involve  the  outputs  (y  Ty  9)  ,  (y  7)  and 
and  produce  the  transmission  ’pros  *  '  " 


( y,  y2)  K  -<r8+2.45)(e+4.zis) 

(y 2  yj)  2s?-3s+6  =  ~  -  -r  .  /T*) 

(y*  i'j)  -8+6  -  2(3+3) 


The  system  possesses  five  of  a  possible  six  transmission  zeros  and  three  are  non-minimum  phase.  Any  two 
can  be  chosen  for  the  system  design.  The  obvious  choice  is  to  design  an  output  observer  using  the  two  meas¬ 
urements  y,  and  I* r .  The  third  measurement  y7  is  not  required.  In  fact,  an  observer  set  for  the  measurement 
pair  ij2y:  is  given  by 


[i:]-r  ][  H  :  .  jU 


Figure  2  shows  the  observer  system  that  can  be  used  in  feedback  control  to  produce  a  control  law  equiva¬ 
lent  in  every  sense  to  a  state  feedback  control  law.  Two  simple  filters  serve  the  same  purpose  as  addition 
al  sensors.  If  the  feedback  control  system  had  been  designed  originally  with  three  sensors  and  sensor  *3 
failed,  a  reversion  to  the  observer  system  shown  in  Figure  2  would  yield  exactly  the  same  closed-loop  dyna¬ 
mic  response.  Therefore,  the  use  of  output  observers,  even  if  not  used  to  mechanize  the  system  originally, 
produces  a  method  of  obtaining  analytic  redundancy  with  no  less  in  performance  or  dynamic  behavior. 

Flight  Control  Application 

The  fundamental  purpose  of  a  flight  control  system  is  to  enhance  the  flying  qualities  of  the  vehicle. 
Flying  qualities  in  turn  state  that  an  increase  in  the  order  of  the  response  of  the  system  will  amost  al¬ 
ways  degrade  the  flying  qualities  of  the  vehicle.  This  means  that  prefilters,  compensation  networks  and 
the  like  are  inadmissible  unless  the  inclusion  of  these  dynamic  elements  does  not  increase  the  order  of  the 
response  of  the  system.  However,  because  dynamic  elements  are  an  integral  part  of  closed-loop  system  de¬ 
sign  technology,  they  must  be  chosen  as  observers  to  satisfy  stringent  flying  qualities  requirements.  As 
it  turns  out  and  as  shown  by  the  flight  control  system  designs  below,  the  requirement  that  the  filters  be 
observers  is  not  much  of  a  disadvantage  and,  in  fact,  can  simplify  the  design  procedure  considerably.  The 
examples  below  show  several  different  observer  configurations,  all  of  which  produce  the  same  closed- loop 
dynamic  behavior  and  satisfy  flying  qualities  requirements  without  increasing  the  order  of  the  system  re¬ 
sponse  . 


The  example  aircraft  is  a  linearized  approximation  to  the  AFTI-16  on  landing  approach  with  V  =  139  knots. 
The  objective  will  be  to  design  feedback  configurat ions  using  both  an  angle  of  attack  sensor  and  a  rate 
gyro,  a  rate  gyro  alone  and  an  angle  of  attack  sensor  alone.  Because  all  the  control  system  conf igurat ions 
yield  the  same  closed-loop  dynamics,  they  constitute  a  level  of  redundancy  that  can  allow  for  a  failure  of 
either  sensor  without  change  in  the  dynamic  behavior  of  the  vehicle. 

The  small  perturbation  longitudinal -vertical  equations  of  motion  are  given  by 


b 

-0.4932 

G.0CQ12J 

1.4163 

0.0 

V 

0.0 

-0.CS0  7 

-2.861 

-Z2.1? 

kV 

a 

1.000 

-O.CC 127 

-C.S164 

0.0 

Act 

0 

_  1.SC0 

0.0 

0.00 

G.  ?  _ 

5  0 

(18) 
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with  transfer  functions 


0  ,  ,  -2. 64481-1.0328*-. 04078 

_  . - — - 

-1 . 644a fs+. 1871 (at. 04221 
D(  a) 


a  .  ,  -0.0717e3-1.683e2-.0BS2a-.0622 

r le> - d<7) - 

-.071 7(8*23. 44) (s2+. 04728*. 037)  (19) 

*  0(e) 


and  Ois)  -  (a+0 .724) (b-1 .70S) [e2  +  . 38 ( .204) a+.2Q42 ] 

The  aircraft  is  typical  of  a  statically  unstable  aircraft  with  a  left  half  and  right  half  plane  roots 
and  a  stable  "3rd  mode."  Satisfactory  and  acceptable  flying  qualities  for  this  aircraft  would  result  if 
the  airplane  were  augmented  to  produce  the  following  short  period  and  phugoid  mode  characteristics: 

u>  -2.5  tnd/aea  £  *  0.5 

ep  ap 

*ph- o.l  rad/eec  fy-0.1 

which  defines  the  desired  closed-loop  characteristic  polynomial  of  the  closed-loop  response. 

Ai-aJ  =  a‘t+2.S2ai*6.Sle2+0. 160e+C  .0628  (20) 

Figure  3  shows  the  response  of  the  augmented  or  closed- loop  aircraft  to  a  step  command  pilot  input.  As 
specified  by  the  flying  qualities  requirements,  the  short  term  response  in  angle  of  attack  is  primarily  de¬ 
fined  by  the  short  period  mode  characteristics  of  the  augmented  aircraft,  allowing  for  precision  control  of 
the  flight  path,  which  is  the  primary  control  task  during  the  landing  phase  of  flight.  The  responses  of 
Figure  3  define  the  response  of  all  of  the  observer  configurations,  for  the  residue  of  the  responses  of 
all  the  observer  modes  are  zero  and  do  not  add  to  the  output  response  of  the  vehicle. 

Observer  Designs 

> 

As  defined  by  Equation  (9),  the  feedback  control  law  in  the  phase  variable  form  is  found  simply  by  the 
difference  of  the  coefficients  of  the  powers  of  the  Laplace  transform  variable  a  of  the  closed-loop  and 
open-loop  characteristic  polynomials.  vn  this  form  the  control  law  is  simply 

6  =  -(h-r.ju 

e 

=  -[.C62S+.0S12t.15Ci  .036$,  .631+2. 216, 2. 52-1. 06]to  (*D 

=  [  0.1237  .2065  1.747  1.46)u> 


The  problem  then  simply  becomes  one  of  defining  transformation  x  »  Tu  that  will  yield  control  laws  that 
can  be  mechanized.  As. shown  by  Equation  (10),  the  transformations  are  obtained  from  the  numerator  polyno¬ 
mials  of  the  a/$e  and  0/6^  transfer  functions.  Using  measurements  of  angle  of  attack  and  pitch  rate  and 
the  pitch  rate  numerator  polynomial  root  at  e  =  -0.587  as  one  observer  and  the  angle  of  attack  numerator 
factor  (e2+. 04 "18+ . 027)  as  the  second  observer,  the  resulting  transformation  is 


- 0.0622 
0 
0 

-1.6306 


-  .0852 
-0.0407 
-0.0694 
-0.0717 


-1.683 

-1.032 

-1.644 

0 


-0.071? 

-1.644 

0 

0 


which  yields  the  feedback  control  law 


6  Jb)  =  -(L-D)ff 


(22) 


(23) 


6*.  363ai  s ) - 1 .  cCQ(8 )~1G .  02 


b's) 


o(e) 


(24) 


and  the  system  is  shown  in  the  block  diagram  of  Figure  4. 


Because  the  pitch  rate  transfer  function  is  minimum  phase,  a  control  law  can  be  obtained  using  only  a 
pitch  rate  sensor  and  each  of  the  three  numerator  polynomial  roots  as  observers.  The  resulting  feedback 
control  law  is  given  by 

9fa; 


«  (8) 


-1.S219-2.7 5  -  (e)  -.904 


8-t-0.567 
1.6SQ(8) 

(e*.  58?)  (8*. 0422) 
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and  the  resulting  system  is  shown  in  Figure  5. 

The  integrator  in  the  control  loop  is  required  to  obtain  complete  observabi ! i ty  of  the  system,  but 
a  measurement  of  the  control  input  can  serve  just  as  well,  as  shown  by  the  configuration  of  Figure  6. 

Angle  of  attack  can  be  used  instead  of  the  rate  gyro  to  produce  a  feedback  control  law  yielding  the 
same  flying  qualities.  The  observers  selected  in  this  case  are  centered  around  the  factor  C491s+.  .'Sr 
of  the  a/<5  (b)  transfer  function.  The  resulting  system  has  the  control  law 


k(s) 


f2t) 


iy.* 


The  configuration  is  shown  in  the  block  diagram  of  Figure  7a. 

With  the  exception  of  the  direct  angle  of  attack  path,  the  observers  generally  constitute  low  pass  fil¬ 
ters  in  the  feedback  path.  This  would  be  important  for  an  angle  of  attack  feedback  configuration,  as  shown 
in  Figure  7a,  to  not  increase  the  gust  sensitivity  of  the  aircraft  if  the  angle  of  attack  is  obtained  from 
an  air  data  measurement. 


Because  the  block  diagram  of  the  observers  can  be  manipulated  at  will,  the  block  diagrams  shown  in  the 
figures  would  not  necessarily  represent  a  final  flight  control  system  configuration.  However,  it  would 
occasionally  be  difficult  to  change  the  mechanization  by  incorporating  some  of  the  dynamic  elements  in  the 
feed  forward  rather  than  th-2  feedback  path.  As  shown  in  Figure  7b,  mathemat  ical  ly  equivalent  to  "a,  the 
mechanization  would  require  an  unstable  feedforward  loop,  and  is,  therefore,  unrealizable. 


Control  Law  Approximat icns 


The  control  computation  shown  in  Equation  (23)  requires  the  inverse  of  the  transformation  matrix  A# .  Each 
row  of  the  matrix  is  associated  with  the  output  of .a  sensor  or  observer  and  if,  for  some  reason,  the  feed¬ 
back  path  is  lost,  a  new  control  law  can  be  instantly  calculated  that  would  result  in  i  best  approximation. 

For  instance,  in  Figure  4,  assume  the  feedback  path  represented  by  the  observer  output  _ _ was 

lost.  The  best  approaximat ion  would  then  be  obtained  by  the  control  law  t  .s+. 


where  the  superscript  T  represents  the  matrix  transpose  and  Mj.  is  of  Equation  (21)  but  with  the  4th  row 
of  the  matrix  deleted 


M 


21 


0622 

-  ,0852  -2 

.682 

-0.072? 

0 

- 0.040 7  -1 

.  CSC 

- 1 . 644 

0 

-  .0694  -1 

.644 

0 

The  resulting  control  law  becomes 


(28) 


which  yields  the  closed- loop  response  characteristic  polynomial 

=  (e+.  :aa)  fo+r.  [.’  V  '.  ".r;  r .  ;*  +  .  -v? » 

Stability  is  preserved  but  the  flying  qualities  have  deteriorated  considerably,  with  a  dominant  mode 
damping  ratio  of  r  =  .25  and  natural  frequency  ui  =  .78  rad/sec.  A  conclusion  is  that  it  would  be  better 
to  switch  to  an  alternate  observer  network  if  an  observer  path  is  lost. 

Concluding  Remarks 

Output  observers  have  the  significant  advantage  in  control  system  synthesis  of  yielding  feedback  con¬ 
trol  system  designs  using  fewer  sensors  than  states  without  increasing  the  order  of  the  response  of  the 
system  to  a  command  input.  The  observers  in  themselves  are  unobservable.  Using  the  methods  outlined  in 
this  paper,  the  observer  theory  can  be  very  effectively  used  to  quickly  obtain  feedback  control  system 
configurations  using  a  variety  of  sensors  that  satisfy  the  sam*?  flying  qualities  requirements.  Because 
all  the  configurations  yield  the  same  closed-loop  dynamics,  they  constitute  a  ol lection  of  analytically 


phy*  .ally  redundant  control  laws. 
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SUMMARY 


This  contribution  is  intended  to  provide  both  some  basic  considerations  on  valida¬ 
tion  techniques  for  simulations  and  their  application  to  a  real-time  digital  computer  simu¬ 
lation  with  hardware- in-the-loop  (HWIL) . 


1 .  GENERAL  REMARKS  ON  VALIDATION 

1.1  The  Problem  of  Validation 

Validation  in  general  refers  to  the  assessment  of  the  quality  of  match  of  the  compu¬ 
tational  results  of  simulation  models  with 

-  actual  data  from  similar  real  systems 

-  independent  theoretical  data 

and  the  assessment  of  the  correspondence  with  the 

-  hypotheses  and  assumptions  of  the  conceptual  model. 


1 . 2  HWIL- Simulations 

The  purpose  of  HWIL- simulations  is  the  improvement  of  the  simulation  performance  level 
comparable  with  that  expected  from  the  hardware  and  the  validation  of  the  operational  soft¬ 
ware  and  hardware  at  system  level.  This  can  be  accomplished  by 

-  using  (open-loop)  hardware  test  results  to  update  and  validate  the  subsystem  models 

-  substitution  of  (flight-)  hardware  for  subsystem  models. 

Especially  the  lack  of  experimental  data  from  not  yet  existing  systems  requires  the  sub 
stitution  of  available  subsystem  hardware  for  subsystem  models  to  gain  confidence  that  the 
model  adequately  represents  the  overall  system. 


1.3  Overview  of  Validation-Techniques 

Quantitative  measurement  of  coincidence:  (objective  techniques) 

-  Point  fit  tests:  Measurement  of  point  by  point  coincidence 

(Theil's  coefficent,  regression  analysis,  etc.) 

-  Comparison  of  aggregated  measures: 

Agreement  of  means,  variances 
(Analysis  of  variance  schemes) 

-  Test  of  properties  of  time-series: 

Examination  of  shape  of  amplitude-distributions,  spectral-densities 
cross-spectral  analysis 
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Qualitative  analysis:  (subjective  techniques) 

This  form  of  testing  is  important,  when  the  model  is  used  to  investigate  a  system, 
for  which  exists  a  lack  of  data  for  use  in  validation.  It  is  based  on: 

-  Pattern  recognition  of  human  eye: 

(comparison  of  time  structure,  amplitude  fluctuation  between 
sets  of  output) 

-  Expert  critic  due  to  a  priori  knowledge  about  the  system  or  empirical  evidence*. 

recognition  of  discrepancies  between  model  output  and  underlying 
hypotheses . 

To  ground  this  "common  sense"  validation,  it  is  necessary  to  point  out  the  major 
difficulties  in  selecting  appropriate  quantitative  techniques: 

-  No  appropriate  data  available  for  following  reasons: 

Historical  or  theoretical  data  are  not  available  for  comparison  in  the  case  of  vali¬ 
dating  non-existing  systems. 

The  available  data  are  not  appropriate  for  use  in  validation. 

(Data  have  no  significance  with  respect  to  the  objective  of  the  modelling  exercise 
or  have  low  accuracy) 

Data  have  been  used  in  model  development. 

-  Formal  techniques  are  difficult  to  apply  and  costly: 

They  prove  less  insight  than  direct  examination  (The  structure  in  time  is  destroyed) . 

They  require  a  large  number  of  observations  (Sufficient  samples  for  use  of  spectral 
techniques) . 

Assumptions  are  necessary  for  statistical  tests  (Normality,  common  variance,  statio- 
narity) . 

The  problem  of  setting  a  level  for  deciding,  when  model  and  system  output  are  close 
enough  for  the  purpose,  for  which  the  model  is  intended  requires  particular  insight, 
and  it  is  difficult  to  pick  out  specific  aspects  of  the  output. 


2.  AN  INDUCTIVE  APPROACH  TO  QUALITATIVE  VALIDATION  PROCEDURES 

Since  the  basic  experiment  for  the  validation  described  herein  is  justifying  the  model 
by  interpretation  of  its  output,  the  procedure  is  inductive  and  focuses  on  the  question 

Does  the  simulation  model's  output  agree  within  "acceptable  errors"  with 

-  empirical  evidence 

(replication  of  "real  world"  observations  from  similar  systems  -  retrospective 
method) 

-  the  analyst's  theory  of  the  real  system  described  in  the  theoretical  definition  of 
the  model 

(the  expert  attempts  to  forecast  the  model  behaviour  -  prospective  method) 
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This  approach  requires  the  examination  of  three  questions: 

1 .  What  are  the  main  system  output  variables  over  a  variety  of  test-cases,  that  check 
all  relevant  aspects  of  the  simulation  model? 

2.  How  ought  one  compare  the  model  output  with  "real  world"  results  resp.  assumptions 
about  the  system  behaviour? 

3.  What  coincidence  criteria  should  be  used  to  assess  the  coincidence? 


2.1  Selection  of  Appropriate  Output  Variables 

If  dynamic  data  are  available  from 

-  a  previous  hardware  experiment 

-  analytical  solutions  of  a  mathematical  model 

-  a  theoretical  model  in  the  case  of  substitution  of  hardware  subsystems  for  their  simu¬ 
lated  counterparts 

the  emphasis  is  put  on  the  generation  of  corresponding  simulation  data. 

If  no  previous  data  are  available,  the  emphasis  is  put  on  the  generation  of  signifi¬ 
cant  logical  and  physical  variables,  which  record  the  past  history  or  relevant  properties 
and  characteristics  of  the  (sub-}  system  to  be  validated. 

The  following  criteria  are  proposed  for  the  selection: 

-  Variables  which  reflect  static  resp.  dynamic  properties  of  the  system: 

Appropriate  variables,  to  recognize  initial  status,  transients  (phaseshift  properties 

and  amplitude  attenuation) , 


-  Variables  which  reflect  nonlinear  properties  of  the  system: 

Selected  variables,  to  allow  "handchecking"  of  wanted  discontinuities  (are  amplitudes/ 
slopes  inside  specified  limits?). 

-  Variables  to  monitor  the  logical  flow  of  the  system: 

Main  control  variables,  to  check  the  correct  implementation  of  control-logic  and  system 
variables  which  are  effected  by  the  execution  of  the  control  logic  for  traceback. 

-  Variables  which  are  effected  by  neglecting  of  dynamics,  errors  and  relationships: 

To  check,  if  the  conceptual  approximations  are  satisfied. 

-  Variables  which  reflect  interconnections  between  subsystems: 

To  recognize  the  amount  of  coupling  and  the  propagation  of  disturbances. 

-  "Performance" -Variables: 

To  determine,  that  the  system  meets  the  requirements  established  by  the  specifications. 
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2.2  Selection  of  Appropriate  Test-Conditions 

In  a  first  step,  the  simulation  model  is  tested  under  "soft*'  conditions. 

The  provided  input  should  yield: 

-  a  minimum  of  coupling  between  logically  independent  subsystems  (excite  only  parts  of  the 
system,  to  allow  isolation  of  errors) 

-  small  deviations  from  a  nominal  state  of  the  system  to  recognize  principal  errors  in  the 
relevant  relation&nips  and  to  determine  principal  characteristics  of  the  model. 

Processing  to  the  following  steps,  the  system  should  be  tested  under  ’’harder"  condi¬ 
tions  (hereby  the  objective  of  the  modelling  exercise  is  emphasized)  to  check  the  relevant 
aspects  of  the  simulation  study: 

-  are  the  goals  achieved? 

-  are  the  constraints  being  met? 

A  coverage  of  the  specified  performance  is  to  be  achieved. 

2.3  Comparison  Procedure 

The  comparison  procedure  consists  of  the  match  of  selected  test  results  with  available 
data  and  a  priori  knowledge  about  the  system. 

Match  with  available  data: 

-  Graphical  testing  of  analog  output  (strip-charts)  by  use  of  overlays: 

The  first  step  is  to  verify  the  "overall”  correspondence  of  the  curves  in  time-structure, 
amplitude- fluctuations,  and  frequency  content. 

The  next  step  is  to  pick  out  these  aspects  of  the  output  considered  to  be  important.  The 
examination  is  centered  on  points  (amplitude  and  timing)  and  closed  time  intervalls  (rise- 
times,  asymptotic  bounds,  mean  values) 

-  "Read  outs"  from  digital  output 

This  allows  to  check  the  exact  matching  of  key  variables  at  selected  points  and  over  clo¬ 
sed  intervals  and  the  log  of  the  magnitude  of  critical  values. 

-  "Log"  of  control  logic 

Monitoring  of  timing  and  sequencing  of  major  events  for  comparison  with  flow-charts  resp. 
decision-tables. 

Match  of  a  priori  knowledge  with  selected  test-results. 

The  model  must  exhibit  general  characteristics  of  dynamic  systems: 

-  Continuity  of  state  variables 

-  Amplitude  attenuation  and  phase  shift  properties  must  be  in  accordance  with  the  band¬ 
width  of  the  system 

-  The  frequency  content  of  linear  systems  remains  unchanged 

-  Asymptotic  stability 
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Special  properties  of  feedback  systems  can  be  checked  like: 

-  Tracking  performance 

-  Achievement  of  a  predetermined  steady  state 

-  Estimation  of  true  values  from  disturbed  data 

For  a  particular  model,  the  overall  integrity  has  to  be  demonstrated: 

-  The  generated  results  must  be  "linked"  with  the  associated  assumptions 

-  The  results  must  be  in  accordance  with  other  test  data  (laboratory  tests) 

-  The  performance  data  must  be  achieved  and  constraints  are  being  met. 

2.4  Coincidence  Criteria 

If  corresponding  time  series  are  given,  at  selected  points  considered  to  be  impor¬ 
tant  the  deviation  can  be  read  out  and  viewed  relative  to  the  emphasis  on  the  match  of  cer¬ 
tain  data.  To  assure  that  specified  limits  are  not  exceeded,  an  allowable  performance 
tolerance  bound  can  be  applied. 

If  no  data  records  for  comparison  are  available,  it  is  the  engineer's  job  to  take  the 
model  output  and  to  determine  that  it  meets  prespecified  requirements  within  acceptable 
limits,  irregularities  will  have  a  specific  meaning  to  the  expert  in  most  cases.  The  major 
drawback  of  the  procedure  is,  that  it  does  not  quantify  the  degree  of  coincidence,  the  judge 
ment  is  based  on  a  "data  transformation  model"  that  is  not  made  explicit. 


3 .  SAMPLE  APPLICATION 
3.1  Subject  of  Validation 

Subject  of  the  validation  procedure  described  in  this  section  is  the  HWlL-simulation 
for  the  flight  test  planning  of  a  solid  ram- jet-powered  missile  development  program. 

The  flight  hardware  under  consideration  is  the  onboard-computer,  the  mission  software  to 
be  validated  is  depicted  in  fig.  1. 

The  system-level  test  is  necessary  to  certify 

-  the  performance  of  the  onboard-computer  in  its  operational  environment 

-  the  satisfaction  of  requirements. 

In  the  special  case  of  missile  development  no  inflight  observations  are  available  and 
the  validation  procedure  focuses  on  the  correspondence  between  the  computational  results 
of  the  HWIL- simulation  and  theoretical  data. 

For  the  purpose  of  validating  HWIL  the  required  data  for  comparison  are  obtained  by 
independently  simulating  with  the  validated  theoretical  model  of  the  overall  system. 
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Since  the  assessment  of  the  quality  of  match  and  the  examination  of  differences  bet¬ 
ween  the  data  records  requires  a  lot  of  engineering  judgement,  it  is  necessary  to  have 

-  an  indepth  understanding  about  the  functional  and  desired  operating  characteristics 
of  the  hardware  in  its  operational  environment 

-  knowledge  about  the  goals  for  the  actual  flight  test,  to  assess  the  satisfaction  of  re¬ 
quirements. 

Thus  it  is  possible  to  determine  the  specific  aspects,  where  the  emphasis  of  the  vali¬ 
dation  procedure  is  put  on  in  accordance  with  tr.e  available  turnaround  time  and  validation 
technique.  To  develop  the  necessary  understanding  of  the  requirements,  it  is  necessary  to 
attempt  a  forecast  of  the  general  model  behaviour,  as  for  example  a  timing  diagramm  of  the 
intended  flight  test, 

3.2  Basic  Software  Requirements  for  the  Validation  Procedure 

A  basic  requirements  is  a  validated  theoretical  model  of  the  overall  system,  which 
consists  of  the  following  submodels  for 

Airframe/Kinematics 
Aerodynamic/ Propuls ion 
Guidance/Control 

Missile  Instruments  with  Follow-up  A/D-Conversion 
Servos. 

The  results  taken  from  this  6-DOF  simulation  are  used  as  a  standard  benchmark  for  the 
hardware  under  considerate 

The  model  mus  have  the  following  properties: 

-  Realtime  simulation  capability  tc  exercise  the  operational  software  in  realtime  by 
simulating  its  operational  environment. 

-  A  simulation  performance  level  commensurate  with  that  of  the  hardware. 

The  parts  assigned  to  the  operational  software  are  modeled  in  great  detail.  They  are  imple 
mented  with  scaled  equations  in  16-bit  wordlength.  The  other  simulation  characteristics 
are  close  enough  to  the  actual  systems  characteristics  to  be  able  to  predict  the  system 
performance. 

-  For  the  purpose  of  partitioning  the  theoretical  model  must  be  subdivided  into  submodels  re 
presenting  the  available  subsystem  hardware  and  allow  subsystems  to  be  bypassed  and  the 
corresponding  hardware  inserted  in  their  place.  The  required  simulation  system  is  depicted 
in  fig.  2. 

A  verification  of  the  operational  software  in  open-loop  tests  has  to  be  performed  to 
assure  that  it  is  functionally  equivalent  to  the  represented  algorithms. 

3.3  Hardware  Requirements 

To  assure,  that  the  system  will  perform  reliably  in  its  operational  environment  as 
well  as  in  the  computer  system  test  bed,  the  configuration  must  allow  the  validation  of 
the  flight  hardware  and  software  in  the  same  manner  as  during  actual  operation. 
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This  means: 

-  Identical  software  for  test  cases  and  operational  conditions. 

As  seen  from  fig.  4  the  input  from  actual  hardware  or  main  computer  is  buffered  in 
memory.  Either  of  them  is  identical  zero  depending  on  the  origin  of  the  data  and  an 
addition  is  performed  between  the  registers.  Unnecessary  test-output  is  discarded  during 
actual  operation.  This  technique  requires  additional  software  residence  in  memory  but  no 
modification  for  the  purpose  of  validation. 

-  This  configuration  allows  as  far  as  possible  identical  interfacing  to  simulation  compu¬ 
ter  resp.  hardware  subsystems,  i.e.  most  functions  necessary  for  providing  data  streams 
to  and  from  the  onboard-computer  are  accomplished  with  the  operational  interface. 

-  In  addition,  the  data  transfer  from  a  peripheral  device  or  main-computer  to  memory 
and  vice-versa  is  initiated  at  the  same  prespecified,  identical  fixed  time-intervalls 
for  test  cases  as  under  operational  conditions.  Thus  it  is  verified  that  equivalent 
models  for  hardware  subsystems  yield  equivalent  simulated  results  (ref.  to  fig.  5) . 

A  schematic  of  the  interconnections  between  the  main-computer  and  the  onboard-com¬ 
puter  is  shown  in  fig.  3  resp.  fig.  4.  This  configuration  allows  the  validation  of  the 
flight  software  in  a  test  bed  which  is  a  realistic  representation  of  the  operational 
environment. 


3.4  Simulation  Facility 

The  hardware  and  simulation  facility  required  to  validate  the  HWIL-simulation  is  depic 
ted  in  fig.  6.  It  employs  the  following  major  functional  elements 

-  Main  Computer 

-  Interface 

-  Hardware  System 

-  Peripheral  Device 

and  allows  optionally  to  interface  the  onboard-computer  to  the  system  model  implemented  on 
the  main-computer  and  substitute  it  for  its  simulated  counterpart.  The  E25-Interface  is  a 
direct  memory  access  digital  interface  to  the  onboard-computer,  that  buffers  real-time  data 
in  16-bit  word  lenght  and  transfers  them  in  blocks.  The  data  transfer  from  the  onboard  com¬ 
puter  or  main  computer  to  the  interface  occurs  via  a  program  call  after  completion  of  the 
current  computation,  the  data  transfer  from  the  interface  to  either .computers  is  initiated 
by  the  real-time  clock  at  the  beginning  of  the  basic  intervall.  Each  request  can  be 
synchronously  handled. 


3.5  Validation  through  Substitution  of  Hardware  Subsystems 

In  a  first  step,  the  validation  procedure  focuses  on  the  identification  of  elementary 
errors"  like 

-  Software  errors 

wrong  equations,  wrong  control  of  switching  or  branching  logic,  wrong  parameter  values 
wrong  interprogram  linkages,  code/data  allocation  errors 

-  Hardware  errors 

real-time  requirements  not  fullfilled,  data  ranges  insufficient 
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Those  errors  are  at  first  to  be  removed,  before  further  analysis  of  the  test  data  is 
attempted . 

Apart  from  that,  the  output  cannot  be  expected  to  agree  exactly  because  "high  order” 
errors  introduced  due  to  different  representation  of  basic  external  functions  or  diffe¬ 
rent  numerical  approximations.  Since  no  subjective  assessment  of  "high  order"  errors  can  be 
made,  quantitative  methods  are  necessary  that  characterize  the  degree  of  similarity.  In 
a  second  step,  it  may  be  necessary  to  modify  the  mission-software  to  match  the  theoretical 
results  to  some  level  of  goodness-of-f it . 

There  are  three  test-activities: 

1.  The  validation  procedure  starts  with  the  substitution  of  certain  logically  independent 
parts  of  the  mission-software  for  subsystem  models. 

Performance-resp.  time-critical  modules  like  strap-down  algorithms  or  control  algorithms 
are  chosen,  because  of  their  greater  impact  on  the  system-performance. 

The  great  advantage  of  the  stepwise  substitution  lies  in  the  isolation  of  errors  to  par¬ 
ticular  sections,  which  allows  easy  correction. 

2.  in  the  second  step,  previously  tested  modules  which  are  sequentially  bound,  put  together 
in  groups  and  substituted  for  their  simulated  counterparts.  Thus  the  connections  between 
the  modules  are  checked  in  their  operational  environment. 

3.  This  leads  in  the  last  step  to  the  insertion  of  the  whole  subsystem  hardware  and  the  vali¬ 
dation  of  the  overall  HWIL-simulation.  In  each  step  the  later  described  tests  are  perfor¬ 
med. 


3.6  Test-Cases  and  Test-Techniques 

The  test  runs  started  with  "soft-trajectories"  to  demonstrate  the  "reasonableness"  of 
the  simulation: 

-  ballistic  trajectories  with  soft  single  plane  maneuvers  to  study  the  controllability  over 
the  trajectory.  This  simplifies  the  error  analysis  for  autopilot  axis,  autopilot  modes  and 
strapdown  algorithms  performance. 

The  next  step  is  advancing  to  combined  plane  maneuvers  within  specified  limits,  to  check 
if  system  performance  data  are  achieved  and  constraints  are  met: 

-  flight  conditions  according  to  the  preprogrammed  flight  tests  to  check  the  influence  of 
nonlinear  effects  and  the  logic  flow  especially  in  the  case  of  malfunctions  of  subsystems. 
This  allows  the  synthesis  of  the  intended  flight  test  trajectory. 

The  output  variables  are  chosen  to  exhibit  significant  information  about  the  processing 
of  the  system  inputs.  This  particular  simulation  analysis  concentrated  on  output  variables, 
which  are  related  directly  to  the  onboard  computations:  e.g.: 

-  Inertial  reference  data  for  the  strap-down-calculations 

-  Missile  latax  along  the  trajectory  and  lateral  displacement  for  the  guidance  performance 

-  Autopilot  axes  response 

-  Log  of  autopilot  modes  resp.  guidance  logic 


i 
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The  analysis  starts  with  highly  aggregated  data.  For  a  detailed  examination  of  dis¬ 
crepancies  one  will  resort  to  less  aggregated  data,  e.g. 

elements  of  the  transformation  matrix  to  check  computationally  introduced  errors  in 
strap-down  calculations  $ 

internal  variables  of  the  autopilot  to  check  mode  switching 

The  tests  performed  focus  on  the  comparison  of  the  simulated  variables  with  the 
corresponding  results  from  the  theoretical  model.  The  records  were  either  superimposed 
(data  output  in  analog  form)  or  digital  records  of  point  pairs  where  examined. 

Points  or  time-segments  of  major  interest  are: 

-  Starting  values/initial  slope  of  time  series 

They  are  verified  for  proper  initialization  (discovery  of  scale-errors,  bias) 

-  Discontinuities 

This  check  is  a  useful  aid  for  the  logical  analysis  and  the  analysis  of  the  transient 
behaviour  of  the  system.  It  allows  to  trace  through  the  logic  of  the  system  and  to  visu¬ 
ally  verify  the  interconnections  between  the  subsystems. 

It  includes  the  check,  if  switching  criterias  are  fullfilled  or  unexpected  discontinu¬ 
ities  occur,  the  discovery  of  time-lags  between  corresponding  curves  and  the  analysis  of 
certain  nonlinear  effects  (saturations  etc.) 

The  switching  condition  in  most  cases  yields  a  change  of  the  inputs  or  parameters  of 
the  system.  This  allows  to  assess  the  transient  behaviour  of  the  closed  loop  system  and  to 
trace  back,  if  the  effects  of  abrupt  changes  are  supported  by  the  underlying  model  assump¬ 
tions. 

-  Asymptotic  behaviour  of  the  system 

The  agreement  of  the  time  series,  when  the  dynamics  have  slowed  down  ensures  that  the 
statistic  relations  are  equivalent  and  numeric  perturbations  have  no  signifigant  effect. 

-  Other  significant  points:  extremal  values,  turning  points,  zero  crossings 

A  discrepancy  in  timing  resp.  amplitude  of  these  points  between  corresponding  time  series 
points  out  possible  errors  due  to  numerical  techniques  (introduced  phase-shift,  gain 
errors)  or  different  equations  (error  in  differential  equations,  not  similar  implemented 
limits) 

3.7  Difficulties  with  a  Quantitative  Judgement  of  the  Validity 

The  validation  procedure  is  based  on  a  graphical  approach  and  therefore  subjective. 

A  desired  quantitative  measurement  of  point  to  point  fit  is  restricted  to  appropriate 
time-series  and  in  this  case  is  misleading. 

Due  to  switching  operations  major  time-lags  are  introduced  into  the  system.  Small  de¬ 
viations  in  the  state  of  the  system  can  mean  that  the  switching  occurs  one  time  step  later, 
which  results  in  different  time  histories  but  common  properties  of  trajectories.  The  same 
happens,  if  variables  exhibit  a  limit  cycle  behaviour.  Samples  can  differ  by  a  large  amount, 
if  the  variables  are  slightly  out  of  phase.  A  measurement  of  point  by  point  accuracy  would 
be  improper. 

Comparisons  based  on  aggregated  measures  have  provided  less  insight  than  careful  exa¬ 
mination  at  selected  sampling  points. 


4.  CONCLUDING  REMARKS 

During  the  validation  procedure  was  learned  that  the  HWIL-simulation  is  most  important 
for  the  dynamic  testing  of  flight  hardware.  Laboratory  tests,  which  have  been  performed  be¬ 
fore,  are  strictly  open-loop  and  therefore  failed  to  test  the  important  closed-loop  feature 
of  the  onboard-computer. 

The  HWIL-simulation  results  indicated  that  significant  aspects  of  the  hardware  sub¬ 
system  had  not  been  adressed  by  open-loop  tests,  e.g. 

-  proper  execution  of  the  program’s  branching  logic 

-  proper  implementation  of  parameter  values 

-  real-time  requirements 

-  sufficient  data  ranges 

Finally, 

the  HWIL-simulation  has  proved  to  be  more  representative  of  the  system  and  much  more  confi¬ 
dence  can  be  placed  in  its  simulation  results. 


I 
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SUMMARY 


Despite  potential  advantages  the  use  of  High  Order  Languages  (HOL's)  in  high  integrity  systems  remains 
inadvisable.  HOL  compilers  are  complex  and  difficult  to  validate  and  even  when  correct  may  produce 
unexpected  results.  Methods  are  discussed  for  simplifying  HOL's  so  that  high  visibility  is  maintained 
from  HOL  code  through  the  process  of  translation  down  to  machine  code  level.  These  methods  can  be  ap¬ 
plied  to  standard  HOL's  or  a  new  HOL  can  be  designed  around  them.  The  methods  are  particularly  useful 
in  embedded  systems  (such  as  engine  controllers)  of  low  cost  relative  to  the  facility  to  which  they  are 
applied  and  which  require  considerable  modification  during  trials  or  in  service. 


Introduction 


The  advent  of  low  cost  relatively  powerful  microcomputing  components  capable  of  meeting  the  demanding 
environmental  and  quality  specifications  of  military  applications,  especially  airborne  applications, 
has  led  to  a  revolution  in  the  design  of  embedded  systems  for  the  industry.  Whilst  previous  designs 
were  achieved  purely  by  hardware  means  the. new  computerised  systems  rely  heavily  on  software.  This 
poses  a  number  of  challenges  to  the  system  designer.  Not  only  must  the  new  systems  match  or  exceed  the 
old  in  performance  and  integrity,  they  must  also  achieve  high  visibility  of  design  for  validation  or 
certification  purposes,  and  they  must  also  be  modifiable  as  conveniently  as  the  old  systems  and  without 
compromising  the  other  objectives. 


In  early  products  the  software  was  implemented  in  low  order  languages  such  as  assembly  codes.  This  was 
largely  because  mature  High  Order  Language  compilers  for  the  new  microprocessors  were  not  available,  or 
did  not  provide  the  necessary  real  time  facilities.  This  demanded  highly  disciplined  procedures  for 
software  design,  documentation  and  testing  to  ensure  not  only  reliable  software  performance  in  applica¬ 
tions  which  are  largely  safety  critical,  but  also  that  maintainable  software  would  be  produced. 

By  comparison,  much  software  outside  the  specialised  safety  critical  area  of  embedded  airborne 
applications  has  long  been  written  In  High  Order  Languages.  It  Is  widely  recognised  that  this  has  con¬ 
siderable  benefits  in  terms  of  cost,  ease  of  testing,  documentstlon  and  maintainability.  Unfortunately 
the  use  of  compilers  for  producing  software  in  safety  critical  applications  remains  inadvisable.  Val¬ 
idation  of  compilers,  which  are  often  highly  complex,  is  an  extremely  difficult  and  daunting  task. 
Further,  even  a  fully  validated  compiler  may  produce  results  which  are  unexpected  or  counter  Inltultlve 
in  some  circumstances,  because  the  transformations  Involved  in  the  compilation  process  may  be  complex 
and  not  fully  understood  by  the  programmer.  Therefore,  although  the  use  of  High  Order  Languages  tends 
to  increase  software  visibility,  the  use  of  compilers  tends  to  reduce  It. 

Various  methods  have  been  employed  to  overcome  these  problems,  including  the  use  of  High  Order  Language 
-  like  pseudocodes  to  specify  software  designs  and  low  order  languages  to  Implement  them.  However , 
these  do  not  of  themsslvss  provide  the  convenience  of  modification  with  which  final  users  became  accus¬ 
tomed  before  the  advent  of  software  -  based  systems.  This  problem  has  often  been  tackled  by  resort  to 
direct  modification  at  the  machine  code  level  -  the  so-called  "midnight  patch"  -  which  most  certainly 
compromises  integrity,  visibility  and  maintainability. 

Characteristics  and  Requirements 


The  characteristics  of  software  for  airborne  embedded  systems  may  be  summarised  as: 

1)  Small  to  medlimi  alee.  For  example  an  embedded  system  may 

perform  one  or  a  few  functions  associated  with  engine  control,  each  requiring  1/2K  to  5K  words  of 
program  memory. 
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2)  Designed  to  satisfy  memory  and  run-time  constraints. 

3)  Produced  by  a  development  team  which  is  large  in  comparison 
with  the  program  size  but  not  large  In  absolute  terms. 

4)  Short  preparation  times. 

5)  Extremely  high  integrity  and  reliability  requirements. 

6)  Extremely  long  software  lifetimes  (perhaps  more  than  20  years). 

7)  Maintenance  requirements  commensurate  with  long  software 
lifetimes. 

8)  Often  Implemented  In  low  order  Languages  at  present 

9)  High  complexity  relative  to  program  size. 


10)  Very  often  modified  during  development  or  trials  of  the 

overall  facility  to  which  Che  embedded  system  Is  applied  (such  as  an  aircraft  engine)  -  see  figure 

i. 


11)  The  embedded  system  may  be  of  low  cost  relative  to  the 

facility  to  which  it  is  applied  and  to  the  dally  cost  of  trials  of  such  a  facility. 


Some  requirements  for  embedded  systems  are  therefore; 

1)  High  Integrity,  even  during  a  phase  of 
frequent  modification. 


11)  Low  cost  and  very  fast  and  convenient 

modification  capability.  In  the  extreme  this  might  Include  the  capability  of  modification 
while  a  trial  is  In  progress  to  avoid  the  need  to  halt  and  restart. 


Ill)  High  visibility  of  design. 


lv)  Strict  configuration  control. 


v)  Validation  or  certification  capability. 


vl)  Speed  and  memory  efficiency  (perhaps 
becoming  less  Important), 


vll)  Low  coat  initial  development. 
Clearly  these  are  not  readily  reconciled 


High  Order  Languages  (HOL'a) 

It  la  useful  to  consider  the  characteristics  of  HOL'a  which  make  It  difficult  to  meet  these  require¬ 
ments.  As  stated  above,  the  validation  of  complex  compilers  is  an  extremely  difficult  -  ’  daunting 
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task,  and  even  valid  compilers  may  produce  unexpected  results.  This  Is  particularly  so  with  current 
generation  microprocessors  and  short  word  length  arithmetic.  Intermediate  transformations  performed  by 
compiler  generated  code  and  Intended  by  the  compiler  writer  to  protect  against  overflow  or  preserve  ac¬ 
curacy  may  produce  unexpected  results  for  even  the  simplest  of  operations.  While  it  may  be  acceptable 
(If  undesirable)  that  this  should  occur  In  a  HOL  at  the  extremes  of  value  ranges,  this  phenomenon  is 
not  limited  in  that  way.  A  single  example  will  suffice  (Figure  2).  Although  this  shows  a  result  which 
Is  unexpected,  It  la  not  an  "error".  At  least  If  is  consistent  with  the  language  specification,  and 
the  compiler  which  produces  this  result  is  approved  by  the  relevant  Government  authority.  Further,  the 
Intermediate  transformations  which  give  rise  to  this  result  are  not  standard -between  compilers  for  dif¬ 
ferent  processors  nor  even  necessarily  between  different  Issues  of  the  same  compiler.  The  "visibility" 
of  the  object  code  generation  process  has  been  lost. 

Approaches 

Three  types  of  approach  have  been  followed  in  trying  to  overcome  these  problems, 
i)  Validation 

There  is  continuing  Interest  In  methods  to  validate  complex  compilers,  or  to  validate  particular 
compiled  code  against  its  source.  While  some  progress  has  been  made,  this  is  not  yet  a  solution. 


ii)  Standardisation 

On  a  well-designed  general  purpose  language  and  development  support  tools.  It  is  hoped  that  when 
the  use  of  one  language  becomes  enforced  Co  the  exclusion  of  others  then  it  will  rapidly  acquire  a 
pedigree  of  successful  applications.  But  a  general  purpose  language  which  really  la  suitable  for 
a  wide  range  of  applications  must  necessarily  be  complex  and  involve  the  use  of  a  complex  compi¬ 
ler.  It  Is  by  no  means  certain  that  it  would  be  acceptable  in  high  integrity  applications. 


ill)  Simplification 

This  is  sn  alternative  approach  which  Is  explored  in  this  paper,  tf  the  system  for  translating 
from  a  HOL  Into  object  code  can  be  simplified  and  made  transparent  then  the  above  requirements  can 
be  met,  and  In  this  sense  Integrity  has  been  built  In  to  the  HOL.  Of  course  such  simplifications 
are  likely  to  lavolve  loss  of  general  applicability.  The  applications  should  therefore  be  chosen 
so  as  not  to  restrict  the  usefulness  of  the  HOL  for  airborne  embedded  systems. 


Simp l teat  ion  Concepts 

A  HOL  and  software  system  can  be  conceptually  broken  down  as  follows; 
Software  system  ■  Real  time  executive  +  User  software 


User  software  •  Data  items  +  Permissible  Operators  +  Format  to  express  these. 


For  the  purposes  of  this  paper,  the  real  time  executive  will  be  assumed  to  be  well-proven,  common 
between  systems,  and  not  affected  by  frequent  user  software  modifications.  It  is  not  considered  to  de¬ 
tract  significantly  from  integrity  therefore. 


To  simplify  the  software  system  it  Is  proposed  to  restrict  the  data  types  to  the  minimum  necessary, 
predefine  the  total  numbers  of  entities  of  each  type,  and  define  all  Permissible  Operations  to  have 

i)  A  known  meaning 

11)  An  obvious,  visible  meaning 

ill)  A  least  unsafe  (or  fault  tolerant)  meaning  to 

optimise  integrity  even  during  phases  of  rapid  user  software  modification. 

lv)  A  standardised  implementation,  for  checking  and 
portability. 


,  « 
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The  format  should  be  easily  read  and  understood  and  the  translation  to  object  code  should  also  be  per¬ 
formed  in  a  standard  way. 

Minimum  set  of  data  types 

What  is  an  appropriate  minimum  set  of  data  types?  Clearly  this  will  depend  on  the  application.  For 
example  a  minimum  set  for  real  time  control  of  aircraft  engines  would  not  be  appropriate  for  payroll 
calculations  or  financial  reporting.  The  intention  is  therefore  to  choose  a  minimum  set  appropriate 
for  a  class  of  applications  such  as  real-time  control  and  capable  of  meeting  the  requirements  (accu¬ 
racy,  run-time  efficiency,  direct  mapping  to  hardware  signals  In  the  external  world)  of  this  class. 

An  example  of  such  a  minimum  set  Includes  only  3  types,  namely: 


Single  word  Integer 

Single  word  (16,8)  fixed  point  real 

Single  bit  on/off  switch 


It  is  recognised  of  course  that  this  is  highly  restrictive.  In  this  approach  this  restriction  is 
accepted  for  the  benefits  that  it  implies  and  which  are  to  be  assessed,  and  an  extension  of  this  set  is 
not  desired. 


Predefined  totality  of  data  items 


Whereas  the  minimum  set  of  data  types  is  defined  for  a  class  of  applications,  the  number  of  Items  of 
each  tyupe  available,  e.g.  the  number  of  integers,  any  vary  within  this  class.  But  It  Is  Intended  that 
the  totality  of  data  items  of  each  type  available  should  not  vary  even  during  the  phases  of  frequent 
modification  during  development.  tn  this  way  the  effects  of  user  software  changes  are  restricted  to 
the  operations  performed  on  the  data  items,  but  the  data  framework  itself  Is  stable. 


Permissible  Operations 
Permissible  Operations  are  either 

I)  A  single  arithmetic  or  comparison 

operation,  e.g.  multiplication,  with  overflow  protection  and  clearly  stated  accuracy  and  other  ap¬ 
propriate  characteristics. 

II)  A  single  Input  or  output  operation 
to  external  hardware. 

ill)  A  single  dedicated  albebralc  or 

control  orientated  operation,  e.g.  square  root  or  minimum,  with  the  necessary  protections.  This 
group  Is  likely  to  vary  for  different  classes  of  application. 

Note  that  for  example  an  arithmetic  operation  with  the  desired  characteristics  will  not  normally  be 
available  as  a  single  machine  code  Instruction.  Nor,  except  by  chance,  will  it  be  Implemented  exactly 
by  a  compiler.  It  is  therefore  neceaaary  to  enforce  particular  interpretations  of  arithmetic  and  other 
operatlone. 


The  method  used  Co  do  this  Is  to  perform  Permissible  Operations  by  means  of  "primitive"  subroutines.  A 
primitive  Is  a  very  small  single  purpose  module  to  perform  one  operation  according  to  a  predefined 
schedule.  Primitives  are  themselves  written  in  low  order  languages,  but  they  rapidly  acquire  a  pedi¬ 
gree  from  use  in  a  primitive  library  and  it  Is  not  considered  that  they  detract  significantly  from 
Integrity.  They  can  be  tested  satisfactorily  using  conventional  techniques. 


Permissible  Operations  are  only  defined  for  certain  combinations  of  data  Items  and  all  others  are  re¬ 
jected.  For  example  Integer  -  Integer  and  real-real  arithmetic  are  both  defined  but  mixed  mode 
arithmetic  Is  forbidden.  In  this  way  the  class  of  Permissible  Operations  Is  simplified  and  the  exact 
meaning  of  each  one  is  Immediately  clear. 
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In  the  event  of  an  arlthaetlc  overflow  the  result  of  a  Permissible  Operation  is  held  at  the  maximal 
positive  or  negative  value  respectively  and  Che  occurrence  of  the  overflow  is  logged  for  future  debug¬ 
ging  purposes,  ‘this  is  considered  to  be  the  safest  and  most  acceptable  option  available,  and 
corresponds  to  the  familiar  saturation  of  an  amplifier  in  an  analog  system.  It  Is  an  appropriate 
option  to  provide  some  measure  of  fault-tolerant  protection  for  example  during  a  trials  programme  which 
does  not  allow  sufficient  time  for  full  software  validation  of  numbers  of  software  modifications. 


HOL  Translation  to  Object  Code 

In  order  Co  meet  Che  requirements  for  visibility,  simplicity  and  integrity,  it  is  intended  that  the 
process  of  translation  uses  a  very  strongly  structured,  one-to-one  mapping  process  to  convert  a  line  of 
HOL  code  effectively  into  a  data  table  which  will  link  the  predefined  primitives  to  perform  Permitted 
Operations  on  the  predefined  data  items.  Each  elemental  block  of  converted  code  consists  only  of: 

I)  Instructions  to  fetch  data  items,  which  are 

themselves  predefined,  and  place  them  in  a  standard  transfer  area. 

II)  A  call  to  a  standard  primitive. 


ill)  Instructions  to  return  values 

from  the  standard  transfer  area  to  the  data  items. 


Because  the  form  of  the  translated  code  is  so  restricted  it  is  practical  to  check  it  by  means  of  a  de¬ 
translator  program  or  by  inspection  of  the  translated  object  code.  This  does  depend  on  the  one-to-one 
mapping  between  the  HOL  statements  and  the  blocks  of  converted  code.  It  is  preferred  that  this  mapping 
is  Independent  of  other  HOL  statements,  l.e.  there  is  no  "optimisation"  as  with  a  conventional  compiler 
which  is  why  the  term  "translation"  is  used.  Indeed  for  integrity  the  translation  should  be  similar  to 
a  macro-assembler. 


The  Permitted  Operations  and  their  exact  characteristics  are  not  only  fully  defined  but  also  highly 
simplified.  Therefore  it  becomes  relatively  simple  to  perform  a  static  analysis  of  the  numerical  prop¬ 
erties  of  an  entire  user  program  and  thus  determine  the  effective  accuracy  and  permissible  data  value 
ranges  for  this  program. 


Implementation  -  standard  HOL 

The  techniques  described  in  this  paper  can  be  used  to  best  advantage  within  an  environment  of  specially 
designed  HOL,  host  computer  and  target  high  integrity  device.  However,  for  defence  projects  it  is 
often  necessary  to  use  a  defence  standard  language  such  as  CORAL  66  in  the  U.K.  (reference  1)  or  ADA. 
When  the  techniques  described  in  this  paper  are  used  with  a  standard  language  the  task  of  limiting  the 
use  of  the  language  facilities  becomes  a  software  management  or  quality  assurance  problem.  This  could, 
for  example.  Involve  the  uae  of  a  pre-processor  to  highlight  the  use  of  data  types  or  operations  which 
are  not  permitted.  This  Is  no  different  In  principle,  but  much  easier  In  practice,  to  the  familiar 
restriction  In  high  integrity  software  on  the  use  of  Iteration  loops  unless  they  can  be  proven  to  ter¬ 
minate.  With  a  specially  designed  HOL,  of  course  only  permitted  constructs  can  be  part  of  a  valid 
program. 


The  simplification  concepts  are  implemented  in  a  standard  HOL  as  follows 

I)  Data  types.  A  minimum  set  of  data  types  Is  used. 

II)  Totality  of  data  Items.  The  nuaber  of  data  item  of  each 

type  Is  chosen  to  be  sufficiently  large  for  the  requirements  of  the  system  and  should  not  vary 
even  during  phases  of  frequent  modification  of  the  system.  In  s  typical  control  system  performing 
several  tasks  at  different  recursion  rates  it  Is  preferred  that  all  data  items  be  common  at  least 
to  all  modules  above  the  level  of  primitive  within  a  task,  l.e.  there  Is  no  local  data  below  the 
level  of  task. 

ill)  Permissible  Operations.  The  requirement  is  to  replace  the  use 

of  operations  available  within  the  HOL  by  the  use  of  Permissible  Operations  with  the  desired  char¬ 
acteristics.  For  operations  which  are  not  available  as  standard  within  the  HOL  this  presents  no 
problem.  For  example  operations  such  as  taking  a  square  root  or  Implementing  a  lag-lead  control 
network  are  performed  by  primitives  which  are  accessed  as  subroutine  procedures.  However,  for  ar¬ 
ithmetic  operations  It  it  necessary  both  to  prevent  the  use  of  the  standard  operation  and  to 
enforce  the  use  of  the  Permissible  Operation.  For  example,  an  addition  of  fixed  point  variables 


uy  be  written: 


x  :  «  ADDF  (y,x) 

but  may  not  be  written 

x  :  »  y  +  z 

The  run-time  efficiency  depends  on  the  method  of  parametet  passing  enforced  by  the  compiler,  which  wllL 
not  normally  be  optimised  for  programs  configured  in  this  way.  Benchmark  tests  of  a  CORAL  66  compiler 
for  the  U.K.  defence  standard  Ferranti  F100-L  microprocessor  indicate  a  10X  run  time  overhead  due 
solely  to  the  parameter  passing  method  used. 

The  main  disadvantage  of  this  method  of  writing  the  Permissible  Operations  is  the  loss  of  visibility  at 
the  HOL  level  of  code.  For  example,  the  statement. 

x:«y  +  *-  b*c 

might  become 

x  :  »  ADDF  (y,  SUBF  (r,  MULF  (b,c))) 

It  is  preferable  to  redefine  the  arithmetic  symbols  to  have  the  desired  meanings  where  this  facility  is 
provided  by  the  HOL.  For  example,  the  "overloading"  facilities  of  ADA  might  be  employed  in  this  way 
(reference  2,3). 

Note  that  when  more  than  one  operation  is  called  up  in  a  single  HOL  line  the  structure  of  the  generated 
object  code  will  not  accord  precisely  with  that  of  the  elemental  block  defined  above  since  Instructions 
to  transfer  values  to  or  from  a  standard  transfer  area  will  not  be  generated  by  the  compiler.  It  is 
possible  to  regard  these  values  as  existing  within  an  "implicit  register",  but  this  Is  likely  to  com¬ 
plicate  any  de-translation  for  validation  procedure  according  to  the  characteristics  of  the  compiler 
and  the  target  hardware.  Therefore  it  is  considered  to  be  a  higher  integrity  solution  to  permit  only 
one  operation  per  HOL  line,  although  it  is  recognised  that  this  reduces  program  visibility  and  compre¬ 
hensibility. 

Implementation  -  ZICOL  (c) 

The  techniques  described  In  this  paper  have  been  incorporated  into  an  environment  of  a  specially 
designed  HOL  called  ZICOL  (c)  (ZEUS  Integrated,  Control  Oriented  Language),  a  range  of  host  computers 
from  small  desktop  to  supermini  sixes  and  the  ZEUS  (c)  range  of  high  integrity  target  units  using  the 
Zllog  Z8000  or  Ferranti  FtOO-L  microprocessors.  Host  of  the  target  units  have  been  general  purpose 
controllers  designed  for  use  with  the  system,  but  it  has  also  been  possible  to  adapt  existing  control¬ 
lers  which  were  originally  programmed  in  assembly  code. 

The  minimum  ZICOL  Instruction  set  is  given  in  table  1.  For  most  applications  this  is  extended  to 
Include  additional  libraries  of  Permissible  Operations  and  corresponding  primitives.  Examples  are  data 
validation  (rate  and  range  checking  and  scaling) ,  interfacing  with  special  busses,  and  control  law  im¬ 
plementations.  Note  in  particular  that  operations  of  passing  monitored  information  to  the  host 
computer  are  provided  In  the  minimum  set. 

Modlf lest Ion  -  The  High  Order  Patch 

The  technique  of  translation  to  blocks  of  object  code  which  act  as  a  linking  table  for  primitive  routi¬ 
nes  is  capable  of  very  high  Integrity  but  is  not  particularly  convenient  to  use  during  the  phase  of 
rapid  program  modification.  To  overcome  this  the  independence  of  the  elemental  blocks  Is  exploited  in 
a  novel  way.  During  development  of  a  user  program  the  converted  code  is  augmented  by  additional  code 
interleaved  between  the  elemental  blocks.  This  additional  code  Is  transparent  to  the  application  pro¬ 
gram  but  enables  a  user  to  affect  its  operation,  for  example  making  alterations  to  the  ZICOL  program 
and  activating  or  de-activating  these  changes  In  real  time.  (See  figure  3).  Because  of  the  extreme 
rapidity  with  which  an  unsatisfactory  change  can  be  de-activated  and  because  of  the  fault  tolerance 
built  In  to  the  primitives  it  becomes  as  acceptable  to  make  modifications  with  digital  units  as  it  was 
with  analog  equipments.  At  the  end  of  development  these  features  may  be  removed  and  the  high  integrity 
linking  table  elone  recovered. 

An  alteration  to  a  program  conalsts  of  one  or  more  elemental  blocka  which  nay  either  be  additional  to 
or  replace  existing  elemsntsl  blocks.  Such  an  alteration  is  not  limited  to  a  parameter  change  and  can 
be  a  structural  change  (an  axample  is  shown  In  figure  4).  Since  one  elemental  block  corresponds  to  one 
ZICOL  line  this  modification  process  does  not  compromise  the  Integrity,  visibility  or  maintainability 
of  the  software  development  process.  This  can  be  said  to  be  a  "High  Order  Patch". 
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Performance 


These  techniques  have  been  used  in  a  wide  range  of  application  areas  including  aircraft  control  sys¬ 
tems,  gas  turbine  engine  controls,  weapon  launchers,  torpedo  controls  and  a  combined  engine  and 
transmission  control  for  the  U.K.  Challenger  tank.  The  last  application  has  been  Implemented  both  in 
ZICOL  and  in  CORAL  66,  configured  as  described  above.  Measured  overheads  compared  with  assembly  codes 
are  shown  below,  the  lower  figures  corresponding  to  more  complex  systems. 


Overhead 

Memory 

Speed 

ZICOL 

20-40X 

0-20 

CORAL  (optimised  with 

code  inserts. 

30-40X 

10-30X 

CORAL  (unoptimlsed) 

40-60X 

50-80X 

Conclusion 


By  restricting  High  Order  Languages  for  ranges  of  applications  there  can  be  considerable  increaases  in 
visibility  of  the  process  of  generation  of  object  code  from  highly  visible  source  code.  If  these  res¬ 
trictions  are  built  Into  a  High  Order  Language  then  these  advantages  can  be  utilised  to  accelerate  the 
software  modification  process  without  unacceptable  loss  of  integrity. 

ZEUS  and  ZICOL  are  trade  marks  of  Dowty  Electronics  Ltd. 

(c)  Dowty  Electronics  Ltd.  1982. 
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Software  error  correction 


10Z 


(In  initial  code  4 Z 
During  parameter  changes  3.5Z 
During  system  function  and  self- 
check  changes  2.5Z. 

Datum  6  control  law  parameter 


changes: 

66Z 

Senaor  and  actuator  parameter 
changes. 

IZ 

System  self-check  changes  in 
software. 

IZ(?) 

Minor  system  function  additions 

2X 

Major  system  function  changes. 

2X 

Hardware  changes. 

18Z 

100Z 

-  700  changes 


Figure  1  Projected  modification  breakdown  for  full-authority  engine  controller  over  16  years  (based 
experience  of  current  digital  systems  rnd  last  generation  analog  systems)* 


FIXED  (16,6)  a,x,y,c; 
a  ;  -  (value); 
x  :  -  a; 
y  :  -  s  *  a; 
z  :  -  a  *  a  *  a; 


a 

1.0 

2.0 

4.0 

X 

1.0 

2.0 

4.0 

y 

1.0 

4.0 

16.0 

% 

0.0 

0.0 

64.0 

Figure  2  Simple  CORAL-66  program  and  equivalent  multiplication  table  for  particular  compiler. 


ei 


INTERLEAVED  CODE 

BLOCK  2 

INTERLEAVED  CODE 

BLOCK  3 

INTERLEAVED  CODE 


Figure  3  Use  of  Interleaved  code  to  permit  High  Order  Potches. 


EXAMPLE 


l AG-LEAD  NETWORK 


100  DEFINE  WS1  =  ERROR 

110  DEFINE  WS4  =  OUTPUT 


120  WS2  =  5.5  *  ERROR 

120-1  OUTPUT  =  0.99  *  OUTPUT  +  3.193  *  ERROR  -  2.918  *  WS2 

130  WS3  =  WS2  -  OUTPUT/5. 04 

140  OUTPUT  =  INTI  (WS3)  ♦  WS2  *  0.53 

140-1  WS2  *  ERROR 

Figure  4  Example  of  use  of  ZICOL  to  implement  lag-ieod  network  in  s-piane  and 

as  High  Order  Patch  in  z-piane. 
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TABLE  1 .  INSTRUCTION  SET 


Typt 

Format 

Example 

Assignment 

Vanable-Arithmetic  Expression 

X=A+B*(C-DJ 

Integration 

Vanable=INTn  (Variable) 

X-INTKA) 

|  Differentiation 

Vanabie=DIFn(Vanable) 

X=D1F2(A) 

|  !bghest  Wins 

Vanabie=MAX( Variable) 

X*MAX(  A.B.C  J).etc ) 

t  Lowest  W  ins 

V'anable=MIN(  Variable) 

X*MIN(  A.B.C.D.etc ) 

i  Look-Up  Table 

j  Vanable-LOOKUP  nfVanable)l 
\  (n  is  the  Look-Up  table  No.)  J 

X-LOOKUP3(A) 

Loop  Initialize 

FOR  IN-lnt.  Value  to  Final  Value 

FOR  1-1  to  10 

Loop  Terminate 

NEXT  In 

NEXT  15 

Program  Jump 

GOTO  Line  Number 

GOTO  25(1me  No .25) 

Conditional  Jump 

IF  Conditional  GOTO  Line  No 

IF  X«5  GOTO  95 

i  Subroutine  Call 

GOSUB  Line  Number 

GOSUB  200 

1  Conditional  1 

1  Subroutine  CaL'  J 

IF  condition  GOSUB  Line  No. 

IF  X  >  Y.  GOSUB  45 

|  Return  Subroutine 

RETURN 

RETURN 

1  Rename  Variable 

DEFINE  Vanable«=  Defined  Name 

DEFINE  AOUT3-DRJVE1 

Initialize  Constant 

SETKn-Numeric  Value 

SET  K  1-0.4  5 

Initialize 

Look-Up  Table 

f  Set  LnX*Numenc  Value.  1 

1  Initialize  the  Math  Co-ordinate  j 

SET  L2X-0  4.0.6.0.S. 

Initialize 

j  Look-Up  Table 

|  SET  LnY(mi*Numeric  Value.  1 
|  Pair  Of  The  nth.  Table  j 

SET  L2Y-0. 3.0.9. 1.7, .  . 

Set  Timer 

f  TIMEn-Time  In  Seconds,  n  »s  1 
l  The  Timer  Number  J 

T1ME3-2”?  (seconds) 

Debug  Trace 

|  TRACE  Variable.  Variable Outputsi 
}  Variable  Values  on  Trace  Cycle  J 

TRACE  X.Y.X 

Monitor 

|  MONITOR  ’Text’.  Variable;  1 
[  Continuous  Variable  Output  j 

MONITOR  “SIX'.  X 

Program  Tt. "  nation 

STOP 

STOP 

End  of  Program 

END 

END 

TABLE  1.  Notes 

The  following  symbols  perform  the  function  of  Conditional  Operators 

a  Equal  to  * 

b  Not  equal  to  <  > 
c  Greater  than  > 

d  Less  than  < 


f 


I 
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DEVELOPMENT  AND  APPLICATION  OF  DIGITAL  CONTROL 
FOR  TACTICAL  AIRCRAFT  FLUTTER  SUPPRESSION 

Dr.  Dinesh  S.  Joshi,  Engineering  Specialist  and  Don  F.  Kesler,  Senior  Technical  Specialist 

Flight  Control  Research 
and 

Dr.  Erwin  H.  Johnson,  Engineering  Specialist 
Structural  Dynamics  Research 
Northrop  Corporation,  Aircraft  Division 
One  Northrop  Avenue 
Hawthorne,  California  90250 


SUMMARY 

Active  control  methods  have  been  applied  to  synthesize  and  mechanize  digital  control  laws  for  tactical 
aircraft  flutter  suppression.  Several  methods  to  digitize  analog  control  laws  have  been  compared.  The 
State  Space  Method  with  Jordan  Canonical  Transformation  offers  a  systematic  and  efficient  digital  flutter 
control  design  for  multivariable  systems.  A  transonic  wind  tunnel  test  conducted  under  a  U.S.  Air  Force 
contract  conclusively  demonstrated  the  feasibility  of  digital  implementation. 


INTRODUCTION 

Flutter  is  an  explosive  phenomenon  in  which  the  aerodynamic  forces  feed  energy  into  the  aircraft 
structural  system  through  interacting  natural  modes.  If  uncontrolled,  flutter  can  destroy  the  structure 
through  divergent  oscillations  in  a  fraction  of  a  second.  Passive  means  to  control  flutter  require  ex¬ 
pensive  structural  modification  or  the  imposition  of  speed  placards  which  reduce  the  aircrrft  speed  capabil¬ 
ity  and,  thus,  decrease  its  survivability.  Active  flutter  suppression  has  shown  promise  of  preventing 
wing/ store  flutter,  with  potential  for  providing  significant  improvements  in  aircraft  operation  and  mission 
effectiveness. 

For  the  past  nine  years,  Northrop  has  been  researching  flutter  suppression  technology  and  has  in¬ 
vestigated  its  applications  to  tactical  aircraft  (References  1,  2,  and  3).  In  these  research  programs,  ana¬ 
log  control  laws  were  synthesized  via  least  square  and  optimal  control  techniques.  To  demonstrate  the 
effectiveness  of  these  control  laws  in  flutter  suppression,  several  wind  tunnel  tests  were  conducted  on  a 
half  span  YF-17  wing/ store  scale  model.  The  results  show  a  70  percent  improvement  in  the  flutter  dynamic 
.  pressure  through  active  control.  Although  the  analog  mechanization  of  these  control  laws  was  highly  suc¬ 

cessful,  a  transition  to  digital  control  is  desirable  because  of  the  advances  in  digital  fly-by-wire  technol¬ 
ogy.  The  use  of  a  digital  computer  to  perform  control  tasks  is  in  line  with  general  transition  of  aircraft 
control  systems  from  analog  to  digital  devices.  In  addition  to  the  microprocessor  technology  applications, 
the  advantages  of  digital  logic  are  accuracy,  flexibility  and  the  ease  of  multiplexing  a  given  computer  on  a 
time  shared  basis. 

The  primary  objective  of  this  paper  is  to  compare  methods  to  mechanize  digital  contrcl  laws  from 
their  analog  counterparts.  The  methods  include: 

1.  Generalized  State  Space  Method 

2.  State  Space  with  Jordan  Canonical  Transform 

3.  Phase  Variable  Canonical  Transform  (Z-Transform) 

4.  Prewarped  Tustin  Transform. 

Although  the  end  results,  a  set  of  difference  equations  providing  control,  are  similar,  each  of  the 
methods  is  numerically  different.  This  paper  presents  the  results  of  digital  simulations  of  several  YF-17 
flutter  configurations  stabilized  by  digital  control  laws.  In  addition,  the  results  of  a  recent  wind  tunnel 
test  to  demonstrate  the  feasibility  of  digital  flutter  control  have  been  summarized  and  included  in  this 
paper . 

CONTROL  LAW  SYNTHESIS 

!  The  flutter  suppression  control  laws  were  synthesized  by  least  square  (Reference  3)  and  optimal 

,  control  techniques  (Reference  4).  Table  1  summarizes  the  salient  features  of  the  three  selected  control 

laws  used  on  a  YF-17  flutter  configuration. 

Least  Square  Synthesis.  The  essence  of  the  least  square  synthesis  technique  described  in  Reference 
3  is  to  Take  outputs  frorrT specified  sensors  and  to  blend  them  in  such  a  way  that  the  total  signal  closely 
approximates  that  of  the  following  equation: 

svf2 

d(s)  =  - i - 2  (1) 

s  +  2  fafS  +  Wj. 


where  d(s)  is  the  desired  signal,  s  is  the  Laplace  operator,  is  the  frequency  of  the  flutter  mode,  and  ( 

is  a  damping  parameter.  The  transfer  functions  of  each  of  the  sensor  responses  can  be  generated  analyt¬ 
ically  or  experimentally.  If  the  transfer  functions  from  n  sensors  are  denoted  by  h.(s)  (i  =  1,  2,  ...  n), 


1 

I 


i 

i 


t; 

i *•  f- 

1  IS 

*  fa 

■ 
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the  least  squares  technique  determines  the  complex  weights,  R.  which  minimize  the  error  between  the 

desired  signal  and  the  signal  that  is  to  be  fed  back.  For  a  continuously  defined  transform,  the  error  term 
between  the  desired  and  the  blended  signal  is 


e(s)  =  d(s)  -  £  R.h.(s) 
i=l  1  1 

TABLE  1.  SELECTED  YF-17  FLUTTER  CONTROL  LAWS 


CONTROL  LAWS 

CONTROL  SURFACE 

ACCELEROMETERS 

SYNTHESIS  TECHNIQUE 

LEADING  EDGE 

TRAILING  EDGE 

A1 

— 

A2 

A3 

— 

A4 

Nl 

X 

X 

X 

LEAST  SQUARE 

N3 

X 

X 

X 

X 

LEAST  bQUARE 

N4 

X 

X 

X 

X 

L 

X 

X 

optimal  control 

For  a  practical  application,  the  transfer  functions  are  evaluated  at  r  discrete  frequencies  and  a  mean 
square  error  is  formed. 


E 


2 


^  «k  2  =  (DT  -  RTH>  (D  -  nTR) 


(3) 


where  D,  R,  and  H  are  matrix  representations  of  the  scalar  terms  given  in  Eq.  (2)  with  dimensions: 
r  x  1,  n  x  1.  and  n  x  r  respectively-  The  superscript  (  )  denotes  complex  conjugate,  while  the  T  super¬ 
script  signifies  the  transpose.  The  'R’  vector  can  ‘~e  determined  by  setting  the  derivatives  of  E2  with 
respect  to  'R'  to  zero  and  solving  the  resulting  system  of  simultaneous,  linear  complex  equations.  The  re¬ 
sulting  maxtrix  equation  for  *R'  has  the  following  simple  form: 

(HHT)R  =  HD  (4) 


This  least  square  synthesis  procedure  provides  a  simple,  effective  means  of  synthesizing  an  arbitrary  num¬ 
ber  of  transfer  functions  into  a  robust  feedback  signal.  The  block  diagrams  of  the  specific  control  laws 
Nl,  N2,  and  N3  are  shown  in  Figures  1,  2,  and  3.  C  and  II  for  all  the  block  diagrams  are  given  below. 


FIGURE  1.  CONTROL  LAW  Nl 
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94  « 28,900 


Jc  ye  5 

s,1>*  (s  +  94)  (s  +  204s  +  28,900) 


124  •  19,044 


s,  TE 


(s  ♦  124)  (s6  +  138s  ♦  19,044) 


H  = 


S*  +  45590 


*  ZT 


69700 


S*  +  213S  ♦  45590  (0.03S  +  1)  (0.01  5S  +1)  S  +  264S  +  69700  S  ♦  10 


FIGURE  2.  THE  THREE  TRANSDUCER  CONTROL  LAW  N3 


Optimal  Control  Synthesis.  The  performance  and  effectiveness  of  single-surface  control  laws  can  be 
significantly  Improved  by  the  use  of  multisurface  optimal  control  laws.  Reference  4  details  an  optimal  con¬ 
trol  approach  to  aircraft  flutter  suppression  and  load  alleviation.  Primarily,  this  design  involves  the 
determtn*»i-  '  of  three  gain  matrices  in  the  feedback  network.  A  fixed  format  introduces  a  number  of  judi¬ 
ciously  fu  '  »d  poles  in  the  feedback  transfer  function  which  augments  the  optimization  procedure.  Once 
the  controller  function  is  determined,  the  complete  closed-loop  system  is  examined  for  stability  margins. 

The  controller  is  synthesized  through  the  minimization  of  a  performance  index.  Figure  3  shows  the  results 
of  this  procedure  applied  to  YF-17  flutter  control.  The  significance  of  this  multivariable  controls  design  is 
the  utilization  of  two  surfaces  and  four  accelerometers. 

DIGIT AL  CONTROL  LAW  MECHANIZATION 

Theoretical  background  and  the  application  of  four  methods  to  digitize  the  control  laws  synthesized 
in  the  previous  section  are  presented  in  the  following  discussion. 

Generalized  State  Space  Method.  The  generalized  state  space  method  for  digitizing  analog  control 
laws  transforms  a  continuous  system 


x  =  Ax  +  Bu 

y  =  Cx  (5) 


into  a  discrete  system. 
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FIGURE  3.  A  TWO-SURFACE  CONTROL  LAW  N4 


The  exact  solution  of  Eq.  (5)  is 


x(t)  =  x(tQ)eA(t  '  t0) 


j  eA<t  'T)Bu(T)dr 


(6) 


Consider  the  situation  in  which  the  state  and  the  output  variables  are  sampled  periodically  in  time,  so  that 
their  values  are  available  every  T  seconds  at  t  =  kT.  When  t  =  kT  is  substituted  in  Eq.  (6),  we  obtain: 


x(kT) 


A(kT 


kT 


xCt„)  +  J 


A(kT 


,Bu(r)dr 


(7) 


Similarly,  at  t  =  (k  +  1)T,  we  have: 


xl  (k  ♦  1)T ]  =  e' 


A[  (k 


1)T  '  Vx(y 


(k  +  1  )T 


AKk  +  1)T 


Bu(r)dr 


(8) 


AT 

Multiplying  Eq.  (7)  by  e  and  subtracting  from  Eq.  (8): 


x[(k  ♦  1)T1  =  eATx(kT)  *  1)TeA|lk  *  1)T  "  TlBu(r)dr 

kT 


(9a) 
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and 


y  [  Ck  +  1)T]  =  Cxi (k  +  1)T] 


(9b) 


To  further  simplify  Eq.  (9)  let  u(t)  =  u(kT),  kT  5  t  i  (k  +  1)T.  This  is  analogous  to  a  snmpled-datn 
model  with  a  zero  order  hold  as  shown  in  Figure  4. 


FIGURE  4.  SAMPLED  DATA  SYSTEM 


Thus,  Eq.  (9)  can  be  rewritten  as: 


x[(k  *  1)T1  =  eATx(kl' 


T)  +  L 


(k  +  1  )T 


kT 


AKk  +  1)T  -  r] 


Bu(kT)d7 


Since  this  is  a  stationary  system: 


(10a) 


+  ”TeA'(k  +  1)T  -T)dr=  JTeA(T  -T)dr, 
kT  0 


T  A 
t  At  , 
j  e  dr 

b 


(10b) 


Finally,  the  discrete  system  equations  can  be  written  ns: 


xUk  +  1)T  ]  =  eATx(kT)  + 


T 


At, 


(ID 


or 


x  [  ( k  ♦  1 )  T  J 


F  x(kT)  +  G  u(kT) 


(12a) 


y l (k  ♦  1)T]  =  C  x[ (k  ♦  1)T) 


(12b) 


By  forming  an  approximate  sampled-data  model,  it  is  possible  to  obtain  the  states  and  outputs  of  a  contin¬ 
uous  linear  system  at  discrete  instants  in  time.  These  equations  can  easily  be  programmed  on  a  digital 
computer  to  provide  the  digitally  simulated  system  responses.  The  computer  algorithm  which  generates  the 
F  and  G  matrixes  uses  a  series  expansion  for  the  exponential: 


F  =  e 


AT  _  v*  T1  A1 


£> 


„  rT  a^  4s  t*  + 1  a1 
G  =  l  e  dT  s  £  ~  <i  *~ITt 


(13) 


(14) 


One  of  the  important  considerations  in  mechanizing  digital  control  laws  is  their  real  time  operation  on 
microprocessor-based  computers.  Because  the  flutter  suppression  control  laws  are  high  order  systems 
(e.g.  N1  and  N3  are  of  11th  order  and  N4  is  of  15th  order),  the  generalized  state  space  method  will 
2 

require  N  (order)  multiplications  for  real  time  operation.  This  could  not  be  achieved  in  real  time  on  the 
SEL-32/55  digital  computer  selected  for  the  control  law  mechanization.  To  minimize  the  number  of  multi¬ 
plies  a  canonical  transformation  was  used  to  diagonalize  the  characteristic  matrix  A. 

State  Space  with  Jordan  Canonical  Transformation.  The  basic  state  space  Eq.  (5)  can  be  trans¬ 
formed  to  a  Jordan  canonical  form.  The  transformed  system  improves  the  computational  efficiency  by 

2 

reducing  the  number  of  multiplications  from  N  to  about  3N.  It  is  possible  to  find^a  nonsingular  matrix  P 
that  wiB  transform  a  square  matrix  into  the  Jordan  canonical  form. 
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Define  x  =  PZ  so  that, 

Z  =  P~'aPZ  ♦  P_1Bu 

Y  =  CPZ  and  Z(0)  =  P_1x(0)  (15) 


Note  that  P  *AP  =  DIAG  (Aj,  Ag  ...  An)  and  the  columns  of  P  are  the  Eigenvectors  of  A,  where  the  Aj, 
*2'.-  An  are  the  Eigenvalues  of  matrix  A.  In  this  mechanization  some  numerical  problems  were  encountered 

for  repeated  Eigenvalues  for  each  of  the  three  control  laws  (A  =  -12).  This  was  overcome  by  slightly  sepa¬ 
rating  the  poles  at  s  =  -12  (i.e.  s  =  -12.1,  -11.9,  etc.).  Once  the  diagonalization  is  achieved,  the  gen¬ 
eralized  state  space  method  can  be  used  to  discretize  the  continuous  system.  Control  laws  Nl,  N3,  and  N4 
were  mechanized  by  this  technique  and  the  results  are  shown  in  Figures  5,  6,  and  7.  In  all  the  time  his¬ 
tory  figures,  the  flutter  is  allowed  to  build  up  with  the  loop  open,  and  then  the  loop  is  closed.  The  ef¬ 
fectiveness  of  the  control  can  be  measured  by  the  envelope  damping  after  the  loop  is  closed.  In  each 
case,  the  digital  control  law  stabilized  a  YF-17  flutter  configuration.  It  should  be  noted  that  state  space 
law  can  be  used  for  both  multi-input /single-output  (MISO)  (Nl  and  N3)  as  well  as  multi-input/multi-output 
(MIMO)  (N4)  systems.  The  important  asset  of  this  mechanization  is  the  ability  to  mechanize  multi-input/ 
multi-output  control  laws  often  encountered  in  flutter  suppression  applications. 
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FIGURE  5.  STATE  SPACE  MECHANIZATION  OF  Nl  CONTROL  LAW 
(SAMPLE  TIME  10  MSEC) 
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z  =  Px,  X  =  P~!z 


(16) 


TIME  -  SEC 

FIGURE  7.  STATE  SPACE  MECHANIZATION  OF  N4  CONTROL  LAW 
(SAMPLE  TIME  10  MSEC) 

Then  Eq.  (12a  and  12b)  become  (using  ^(z)  *  F  andT(r)  =  G) 

p'1*  (t+r)  =  «(r)  P'1  z(t)  +r( T)Bu(t) 
z(t*r)  =  P*(r)  P'1  z(t)  ♦  Pr(r)BuCt) 

y  =  CP_1z  I 


The  transform  P  is  such  that  the  state  equation  takes  the  form  (for  a  fourth  order  system  with  a  single 
input) 


0  10  0 

0  0  10 

0  0  0  1 

.sss  CJ 

It  is  seen  that  the  implementation  takes  the  form: 


Z(t+T) 

0 


1 


Zj(t+T) 
Z2<t  +  T) 
z3(t+T) 
Z4(t+r) 


CjZj(t)  +  CjZjCt)  ♦  CjZj(t)  +  C^z^(t)  +  u 


where  D  =  IIP 
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This  form  takes  2N  multiplies  and  N  delays.  Multiple  outputs  are  formed  by  using  more  rows  in  the 
H  matrix.  Multiple  inputs  can  be  used;  however,  only  one  input  satisfies  the  phase  variable  canonical 
form.  The  state  transition  matrix  remains  the  same,  but  the  input  matrix  no  longer  has  only  one  nonzero 
term.  The  other  columns  multiplying  u  are  general.  The  disadvantages  of  this  form  is  its  transfer  func¬ 
tion  nature.  This  causes  the  C  terms  to  have  a  high  dynamic  range  of  numbers.  The  numbers  range 
from  one  to  the  product  of  the  roots.  Because  of  these  numerical  problems,  this  method  was  not  further 
investigated. 


Prewarped  Tustin  Transform.  The  most  commonly  used  implementation  of  analog  control  laws  in  a 
digital  computer  is  the  TusHn  transform.  The  main  reason  for  this  popularity  is  the  ability  to  cascade  the 
filters  and  thus  insert  nonlinear  elements  and  gain  changes.  In  systems  where  these  elements  are  neces¬ 
sary,  state  variable  methods  have  serious  shortcomings.  Prewarping  (Reference  6)  is  used  to  correct  the 
frequency  distortion  that  occurs  with  the  Tustin  transform.  A  step-by-step  set  of  rules  for  filter  design 
via  bilinear  transformation  is  presented  in  Reference  6.  Following  the  prewarping  it  can  be  shown  that 
Tustin  transformation  maps  roots  from  the  S-plane  to  the  Z-plane  such  that  a  real  root  located  at  s  =  -fi 


will  map  to  a  real  root  located  at  z  =  e 


-fir 


,  and  a  pair  of  complex  conjugate  roots  with  the  characteristic 


2  2 

polynomial  (s  +  c)  +  d  will  map  to  a  pair  of  complex  conjugate  roots  with  the  characteristic  polynomial 
2  -cT  _2cT 

z  -  2e  cos  dT  z  +  e  .  Band-limited  transforms,  such  as  low-pass  filters  with  more  poles  than 
zeros  have  additional  zeros  inserted  at  z  =  -1  such  that  the  orders  of  the  denominator  and  the  numerator 
of  G(z)  are  the  same.  The  effect  of  these  zeros  at  z  =  -1  (for  low-pass  filter  forms)  is  to  introduce  a 
’’notch"  characteristic  in  the  frequency  response  of  the  digital  filter  at  the  half-sample  frequency .  This  is 
in  addition  to  the  desired  low-pass  characteristic  for  which  the  filter  was  designed  and  may  be  regarded  as 
a  "free”  noise  rejection  capability  of  the  digital  filter  at  frequencies  near  the  half-sample  frequency. 


The  complete  algorithm  can  be  stated  as  follows:  Given  a  continuous  transfer  function. 


?  =  G(s)  = 


K'  Ji  (s  +  V  i=i  ((s  +  V2  +  bi2) 
£/•♦'!>  ^((S  +  Ci>2  +  di2) 


a  digital  filter  approximating  G(s)  is  given  by 


l-CW  - 


K"(z  ♦  1) 

k  ra„  1 

iV 

f  -.T] 

*  e  ) 

1  2  -"T 

,z  -2e  cos  b.Tz  +  e 

~2aiTj 

hi 

1 

f  •* 

-PjT 

\k[* 

2  -2c.  T 

-  2e  cos  d.Tz  +  e 

1 

(20a) 


(20b) 


where  k  =  r  +  2t-m-2n  and  K”  is  determined  by  the  condition  G(z)  |  z=+1  =  G(s)|s_q.  Tf,e  difference 
equations  were  programmed  so  that  z”n  Y(k)  =  Y  (k-n)  and  z”n  u(k)  =  u  (k-n). 

The  results  of  this  mechanization  for  control  laws  N1  and  N3  are  shown  in  Figures  8  and  9.  It 
should  be  noted  that  the  Tustin  mechanization  of  the  N4  control  law  was  not  attempted  because  of  its  MIMO 
nature  and  the  resultant  complexity  of  this  mechanization.  The  advantage  of  this  method  is  its  ease  of 
implementation  for  single  input/ single  output  systems  as  well  as  its  ability  to  accommodate  nonlinearities . 

WIND  TUNNEL  TEST 

Under  a  U.S.  Air  Force  Contract,  Northrop  conducted  a  wind  tunnel  test  to  demonstrate  the  feasi¬ 
bility  of  digital  control  for  flutter  suppression  (Reference  7).  Figure  10  shows  the  configuration  of  the 
model.  Several  control  laws  were  mechanized  by  the  State  Space  Jordan  Canonical  Transformation  method. 
In  this  test,  the  feasibility  and  the  effectiveness  of  digital  control  were  conclusively  demonstrated. 

Figures  11  and  12  show  the  salient  results  of  this  wind  tunnel  test. 

Figure  11  shows  that  the  digital  laws  performed  comparably  to  the  analog  laws  where  zero  damping 
parameter  represents  a  flutter  condition.  By  using  digital  control,  the  YF-17  flutter  dynamic  pressure  was 
improved  by  100  percent  (Q/Qf  =  2.0)  of  the  open  loop  dynamic  pressure.  Figure  12  shows  the  effect  of 

sampling  time  on  the  digital  control  law.  The  digital  control  law  performed  adequately  up  to  T  =  10  msec. 
As  the  sampling  frequency  was  decreased  further,  a  significant  degradation  was  observed  at  T  =  15  msec. 
Adequate  performance  at  10  msec  is  an  important  result,  because  this  time  is  typical  of  the  sample  time  em¬ 
ployed  in  aircraft  digital  control  systems. 
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FIGURE  9.  TUSTIN  MECHANIZATION  OF  N3  CONTROL  LAW 
(SAMPLE  TIME  2.S  MSEC) 
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FIGURE  12.  EFFECTS  OF  SAMPLE  TIME  ON  DIGITAL  CONTROL 
LAW  PERFORMANCE 


CONCLUDING  REMARKS 


The  successful  development  and  application  of  digital  control  for  tactical  aircraft  flutter  suppression 
has  been  conclusively  demonstrated,  both  analytically  and  experimentally.  The  key  conclusions  are  summa¬ 
rized  in  the  following  discussion: 

1.  The  optimal  control  synthesis  of  flutter  suppression  control  laws  are  often  M1MO  systems.  Thus, 
they  require  input  from  several  sensors  and  the  multi-surface  actuation  (output)  to  effectively 
control  flutter  instability. 

2.  Of  the  four  mechanization  methods  discussed  in  this  paper,  Tustin  Transform  and  diagonalized 
State  Space  methods  show  the  most  promise  for  flutter  applications.  The  Tustin  Transform  is 
best  where  nonlinearities  exist  and  the  system  is  single  input/single  output.  For  MIMO  systems, 
the  State  Space  method  provides  a  systematic  and  computationally  efficient  mechanization.  A 
Jordan  canonical  diagonalization  is  necessary  because  the  flutter  control  laws  are  generally  high 
order  syster.  (e.g.  N4  is  15th  order). 

3.  For  control  laws  N1  and  N3,  the  prewarped  Tustin  Transform  and  State  Space  mechanization  pro¬ 
vide  identical  results. 

4.  Wind  tunnel  test  results  indicate  that  the  performance  of  a  digital  control  law  is  comparable  to  its 
analog  counterpart. 

5.  Despite  its  complexity,  the  digital  flutter  control  system  mechanization  and  sample  time  frame  are 
compatible  with  other  aircraft  digital  control  systems. 
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SUMMARY 

A  cooperative  advanced  digital  research  experiment  (CADRE)  was  established  by  the  National  Aeronautics 
and  Space  Adninistration  (NASA)  and  the  Royal  Aircraft  Establishment  (RAE),  in  which  nonlinear  control 
algorithms  developed  by  the  RAE  were  tested  on  the  F-6C  digital  fly-by-wire  (OFBW)  aircraft  based  at  the 
Dryden  Flight  Research  Facility.  In  the  initial  phase  of  the  collaboration,  some  variable-gain  algorithms, 
referred  to  collectively  as  variable  integral  control  to  optimize  response  (VICTOR)  algorithms,  were  flight 
tested.  With  VICTOR,  various  measures  available  within  the  control  system  are  used  to  vary  gains  and  time- 
constants  within  the  closed  loop  and  thereby  enhance  the  control  capability  of  the  system,  while  reducing 
the  adverse  effects  of  sensor  noise  on  the  control  surfaces.  A  review  of  design  procedures  for  VICTOR  and 
results  of  preliminary  flight  tests  are  presented.  The  F-8C  aircraft  is  operated  in  the  remotely  augmented 
vehicle  (RAV)  mode,  with  the  control  laws  implemented  as  FORTRAN  programs  on  a  ground-based  computer. 

Pilot  coirmands  and  sensor  information  are  telemetered  to  the  ground,  where  the  data  are  processed  to  form 
surface  commands  which  are  then  telemetered  back  to  the  aircraft.  The  RAV  mode  represents  a  single-string 
(simplex)  system  and  is  therefore  vulnerable  to  a  hardover  since  comparison  monitoring  is  not  possible. 
Hence,  extensive  error  checking  is  conducted  on  both  the  ground  and  airborne  computers  to  prevent  the 
development  of  potentially  hazardous  situations.  Experience  with  the  RAV  monitoring  and  validation  proce¬ 
dures  is  described. 


SYMBOLS 

DCCL  on-board  pitch  connand,  'eg 

DEP  pitch  stick  command,  deg 

DERAV  pitch  downlink  elevator  coitmand,  deg 

DEUP  pitch  uplink  elevator  command,  deg 

DRATE  maximum  floating  limit  draft  rate,  2.5  deg/sec 

DYNP  dynamic  pressure,  lb/ft2 

Ga  closed-loop  gain 

Gq  baseline  proportional  gain 

(jqv  proportional  nain 

G0  baseline  Integral  gain 

Gov  integral  gain 

Ka  feed-forward  gain 

Mq  normalized  pitching  moment  derivative  due  to  pitch  rate 

normalized  pitching  moment  derivative  due  to  angle  of  attack 
normalized  pitching  moment  derivative  due  to  elevator  deflection 
Q,q  pitch  rate,  deg/sec 

qp  pilot  pitch-rate  demand,  deg/sec 

i  pitch  acceleration,  deg/sec: 

s  complex  frequency  variable 

T  time  delay 

Vq  VICTOR  pitch-rate  gain 


•Crown  copyright  subsists  in  Sec.  2  of  this  paper. 
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V,.  VICTOR  integral  pitch-rate  gain 

Za  negative  of  lift  force  due  to  angle  of  attack 

l  negative  of  lift  force  due  to  elevator  deflection 

a  angle  of  attack,  deg 

u  angle-of-attack  rate,  deg/sec 

i  VICTOR  error  threshold  level 

5 .  second  VICTOR  error  threshold 

e  error 

cv  error  between  pitch-rate  response  and  pilot  demand 
n  elevator  deflection  from  trim  position 
ip  CADRE  elevator  command,  deg 

ta  lead-time  constant  for  phase  advance 
n „  time-constant  of  noise  filter  and  phase  advance 
ijjv  time-constant  of  noise  filter 

t _  time-constant  of  pilot's  filter 

t  VICTOR  error  lead-time  constant 

t  VICTOR  error  lag-time  constant 


1.  INTRODUCTION 

Following  discussions  in  1979  between  RAE  and  NASA  on  collaboration  in  the  fields  of  active  control 
technology  and  handling  qualities,  a  joint  program  of  nonlinear  control  was  established.  In  this  program, 
known  as  the  cooperative  advanced  digital  research  experiment  (CADRE),  nonlinear  flight-control  techniques 
developed  by  RAE  have  been  implemented  and  tested  oh  the  F-8C  digital  fly-by-wire  (DFBW)  research  aircraft 
based  at  Ames  Research  Center's  Dryden  Flight  Research  Facility. 

The  F-8C  DFBW  aircraft  is  operated  in  the  remotely  augmented  vehicle  (RAV)  mode  (Ref.  1),  in  which 
control  laws  are  implemented  as  FORTRAN  programs  on  a  ground-based  computer;  the  control  loop  from  the 
pilot  and  aircraft  sensors  to  the  actuators  is  completed  by  two-way  telemetry.  Since  this  represents  a 
simplex  system,  extensive  error  checking  is  performed  to  prevent  the  development  of  potentially  hazardous 
situations.  Experience  gained  with  the  RAV  monitoring  and  validation  procedures  is  described  in  this  paper. 

The  control  concept  was  initially  developed  by  RAE.  F.  R.  Gill,  the  principal  RAE  advocate  of  non¬ 
linear  control  concepts,  has  proposed  several  novel  control  concepts  offering  potential  benefits  in  both 

control  performan:e  and  handling  qualities  (Refs.  2-5).  One  of  these  concepts,  the  variable  control  to 
optimize  response  (VICTOR),  has  formed  the  basis  of  the  initial  stage  of  the  collaboration. 

Although  the  F-8C  DFBW  aircraft  used  for  the  flight  testing  is  fitted  with  triplex  on-board  computers, 

the  RAV  mode  ’s  used  for  CADRE.  Control  laws  are  implemented  in  a  high-level  language  (FORTRAN)  on  a 

ground-based  computer,  with  the  control  loop  from  pilot  inputs  and  aircraft  sensors  through  the  computer 
to  the  control  actuators  being  completed  by  two-way  telemetry  (Fig.  1).  The  RAV  mode  is  a  simplex  system 
and  is  therefore  vulnerable  to  a  hardover,  since  command  voting  or  comparison  is  not  possible.  Hence, 
extensive  error  checking  is  carried  out  in  both  the  ground  and  airborne  computers  and,  if  an  error  is 
det.cted,  control  is  restored  to  the  on-board  system.  Further  details  of  the  F-8C  RAV  flight-test  tech¬ 
nique,  including  modifications  introduced  for  the  CADRE  flights,  are  given  in  Sec.  3. 

With  VICTOR,  measures  available  within  the  control  system  are  used  to  vary  the  gains  within  the 
closed  loop  and,  hence,  to  enhance  the  control  capability  of  the  system  while  reducing  the  adverse  effects 
of  sensor  noise  on  the  control  actuators.  The  operation  of  VICTOR  is  illustrated  in  Fig.  2.  Normally,  as 
the  closed-loop  gains  increase,  the  control  improves  and  the  noise  effects  become  greater.  On  the  other 
hand,  as  the  gains  decrease,  the  noise  effects  decrease,  but  the  control  also  becomes  less  effective.  The 
VICTOR  method  overcomes  this  conflict  by  allowing  the  gain  to  vary  as  a  function  of  error  signals  within 
the  system,  so  that  the  gains  increase  when  control  is  required  as  a  result  of  pilot  input  or  external 
disturbance,  but  are  allowed  to  reduce  to  a  much  lower  level  once  the  control  requirement  has  been  satis¬ 
fied.  The  design  and  operation  of  a  variable-gain  algorithm,  known  as  VICTOR-E,  implemented  for  a  pitch- 
rate-to-elevator  controller  as  part  of  CADRE,  is  described  in  Sec.  2. 

Initial  flight  tests  of  the  variable-gain  control  laws  commenced  early  in  1982;  they  are  described  in 
Sec.  4.  The  principal  aim  of  the  flight  tests  was  to  establish  whether  a  variable-gain  controller  could 
offer  improved  control  performance  over  a  linear  baseline  system,  and  whether  any  adverse  handling  problems 
were  introduced  by  the  rapidly  varying  gain.  The  task  chosen  for  this  assessment  was  an  air-to-air  tracking 
task,  with  the  F-8C  aircraft  required  to  track  an  accompanying  chase  aircraft  through  a  pushover/pull-up 
maneuver.  These  tests  have  demonstrated  that  a  variable-gain  controller  can  be  designed  to  give  improved 
control  performance  while  maintaining  acceptable  handling  qualities.  In  addition,  the  flight  tests  have 
shown  that  modifications  introduced  into  the  RAV  system  software  for  the  CADRE  tests  have  been  successful 


in  allowing  the  assessment  of  the  nonlinear  control 
envelope  of  the  aircraft.  Finally,  enhancements  to 
nonlinear  control  techniques  into  the  CADRE  program 
initial  flights. 


laws  without  undue  restriction  on  the  maneuver 
the  VICTOR  control  law  and  the  introduction  of  other 
are  discussed  in  the  light  of  experience  with  the 


2.  DESIGN  OF  THE  VARIABLE-GAIN  CONTROLLER1 

The  general  structure  of  the  CADRE  nonlinear  pitch-rate  controller  is  shown  in  Fig.  3.  The  controller 
consists  of  two  parallel  loops:  a  baseline  loop  with  fixed  gains  to  provide  a  datum;  and  a  higher- 
bandwidth  VICTOR  loop,  the  contribution  from  which  is  governed  by  the  variable-gain  algorithm.  This 
parallel  structure  of  the  VICTOR  and  baseline  loops  embodies  part  of  the  concept  of  class  A/B  control 
architecture  (Refs.  6,  7).  The  class  A  system  is  that  needed  to  keep  the  aircraft  flying,  and  the  class  B 
system  combines  with  A  to  provide  high  performance.  In  this  case,  when  the  system  errors  are  small,  the 
class  B  (VICTOR)  gains  are  reduced  to  zero;  but  once  a  significant  error  caused  by  pilot  demand  or  exter¬ 
nal  disturbance  is  detected,  the  gains  in  the  class  B  system  are  allowed  to  increase  rapidly  to  drive  the 
error  toward  zero. 

The  CADRE  control  laws  were  developed  in  two  stages:  the  initial  design  of  the  baseline  and  nonlinear 
control  laws  by  RAE  (Refs.  8,  9),  using  a  simplified  model  of  the  F-8C  short-period  dynamics;  and  the  simu¬ 
lation  and  assessment  of  the  control  laws  at  Dryden  using  a  full  six-degree-of-freedom  model  of  the  air¬ 
craft,  together  with  the  introduction  of  modifications  to  the  RAV  system  software  needed  to  ensure  flight 
safety  (see  Sec.  3). 

The  first  stage  of  the  design  was  performed  at  RAE,  using  the  computer-based  control  systems  design 
package,  TSIM  (Refs.  10,  11).  The  major  part  of  the  design  exercise  was  carried  out  using  a  continuous 
representation  of  the  system,  but  a  discrete  implementation  was  also  simulated  and  the  characteristics 
checked  as  the  design  progressed.  In  addition,  real-time  engineer-in-the-loop  simulations  were  used  to 
check  the  system  performance  for  a  simple  tracking  task.  Finally,  the  CADRE  control  laws  were  converted 
to  difference-equation  form  and  specified  as  a  set  of  FORTRAN  subroutines  for  the  RAV  ground  computer. 

The  CADRE  control-law  subroutines  were  then  evaluated  by  NASA,  and  some  modifications  were  introduced,  as 
specified  in  Ref.  12. 

This  paper  includes  a  summary  of  the  principal  design  criteria  and  constraints,  including  the  aircraft 
and  actuator  dynamics  (Sec.  2.1),  time  delay  (Sec.  2.2),  and  command  prefilter  (Sec.  2.3).  The  baseline 
system  parameters  are  defined  in  Sec.  2. A,  and  the  design  of  the  VICTOR-E  algorithm  is  discussed  in 
Secs.  2.5  and  2.6.  The  final  CADRE  software  includes  eight  combinations  of  parameters  defining  a  range  of 
control-law  options;  these  are  summarized  in  Sec.  2.7.  The  implementation  of  the  control  laws  as  FORTRAN 
subroutines  is  described  in  Sec.  2.8. 

2.1  Aircraft  Model 

The  pitch-rate  controllers  were  designed  for  a  fixed  flight  condition  with  a  Mach  number  of  0.67  and 
an  altitude  of  6100  m.  The  short-period  dynamics  of  the  F-8C  were  modeled  by  linearized  second-order 
equations  of  the  form 


where  q  is  pitch  rate,  a  is  angle  of  attack,  and  n  is  elevator  deflection  from  trim  position. 

The  values  of  the  normalized  derivatives  (such  as  Mq  and  M^)  were  taken  from  the  linearized  six- 
degree-of-freedom  data  given  in  Ref.  13. 

The  primary  and  secondary  actuators  were  represented  by  the  first-  and  second-order  transfer  functions, 
1/(1  +  0.08s)  and  3969/ (s^  +  88s  +  3969),  respectively. 

As  noted  previously,  an  important  effect  of  the  F-8C  RAV  facility  is  the  time  delay  introduced  by  the 
telemetry  link  hardware  and  the  ground  computer.  In  the  early  design  stages  the  delay  was  represented  by 
the  continuous  second-order  approximation 
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where  T  is  the  delay  time. 

A  total  delay  of  50  msec  was  assumed  for  the  system  design,  but  the  initial  flight  tests  indicate 
that  the  total  delay  in  the  RAV  mode  is  about  100  msec,  which  leads  to  some  reduction  in  the  damping  of 
the  systems  (see  Sec.  4). 

2.2  Command  Prefilter  and  Feed-Forward 

The  initial  design  goal  for  the  system  response  to  a  pilot  demand  was  that  the  pitch-rate  response  to 
a  step  input  on  the  stick  should  be  rapid  and  exhibit  as  small  an  overshoot  as  possible.  Normally,  if  no 
prefilter  is  included,  the  aircraft  zero  causes  a  large  overshoot  in  pitch-rate  response  to  a  step  input. 

To  alleviate  this  effect,  a  command  prefilter  of  the  form  (1  +  tas)/(l  +  xzs)  is  introduced.  For  a  second- 
order  model,  the  aircraft  zero  time-constant  tz  is  given,  in  terms  of  normalized  derivatives,  by 
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For  the  design  flight  condition,  tz  *  1.02. 

The  value  of  the  lead-time  constant,  t,,  allows  some  control  over  the  size  of  the  pitch-rate  over¬ 
shoot.  For  xa  =  0,  simulations  showed  that  the  response  was  too  slow  for  accurate  tracking.  On  the 
other  hand,  as  ta  approaches  tz,  the  lag  is  effectively  canceled,  which  leads  to  an  increasing  tendency 
to  overshoot.  Air-to-air  tracking  at  long  distance  (s300  m)  requires  accurate  control  of  pitch  attitude 
through  dead-beat  pitch-rate  response,  whereas  when  the  target  is  close,  height  errors  play  a  more  impor¬ 
tant  part  in  the  task,  and  hence  there  is  an  increasing  emphasis  on  faster  normal  acceleration  response. 
Therefore,  the  original  dead-beat  rate-response  goal  was  changed  for  close  tracking.  Because  of  the 
inherent  lag  between  pitch  rate  and  normal  acceleration  response  to  an  elevator  input,  more  rapid  normal 
acceleration  requires  an  increased  pitch-rate  overshoot,  with  a  consequent  increase  in  the  lead-time  con¬ 
stant,  t a .  Two  values  of  ta  were  included  as  options  in  the  final  software  specification  (Ref.  12) 

(also  see  Sec.  2.7): 


ia  =  0.2  for  distant  tracking  (>150  m) 
ta  *  0.6  for  close  tracking  (<150  m) 


If  no  integral  term  is  included  in  the  control  system.  Gill  (Ref.  4)  shows  that  a  feed-forward  of  the 
pilot  demand  with  gain  Ka  will  lead  to  a  steady-state  error  of  zero.  For  a  second-order  aircraft  model, 
the  feed-forward  gain  Ka,  of  Fig.  4,  can  be  expressed  in  terms  of  normalized  derivatives  as 
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for  the  design  flight  condition.  Although  the  baseline  controller  includes  an  integral  term,  which  will 
itself  act  to  reduce  the  steady-state  error  to  zero,  the  integral  acts  relatively  slowly,  and  it  has  been 
found  advantageous  to  retain  the  feed-forward  element. 

2.3  Baseline  Loop  Parameters 

The  selection  of  the  gain  values,  Gq  and  Ge,  and  the  time-constant,  rN,  is  considered  in  detail  in 
Ref.  8.  It  should  be  noted  that  for  convenience,  the  proportional  and  integral  gains  are  scaled  by  a 
factor  related  to  the  elevator  effectiveness,  G-  =  1/M^  (which  is  equal  to  5.087  at  the  design  flight  con- 
dition),  so  that  the  total  gains  for  the  proportional  and  integral  loops  are  given  by  GaGq  and  GaGe, 
respectively  (Fig.  4).  The  primary  design  criterion  was  to  maintain  a  damping  level  of  about  0.5  on  the 
short-period  mode,  while  making  the  response  speed  as  rapid  as  possible  and  keeping  noise  effects  on  the 
elevator  at  a  reasonable  level.  The  values  selected  were  as  follows: 


Time-constant:  tN  *  0.033  sec 


Proportional  gain:  Gq  *  3.6 
Integral  gain:  G.  *  4.15 


2.4  Design  of  VICTOR-E  Algorithm 

Design  guidelines  for  the  structure  and  implementation  of  variable-gain  control  laws  are  currently 
under  investigation  at  RAE.  In  particular.  Gill  has  evolved  several  strategies  for  gain  variation,  which 
are  described  in  detail  in  Refs.  4  and  5.  One  feature  that  stands  out  from  this  work  is  that  in  order  to 
derive  the  full  benefit  of  a  high-gain  system,  the  variable  gain  must  be  increased  rapidly  once  the  deci¬ 
sion  has  been  made  that  control  is  required.  Hence,  for  the  variable-gain  algorithm  described  here 
(VICTOR-E),  the  starting  point  for  gain  variation  in  the  VICTOR  control  loop  is  a  straightforward  on/off 
switch  controlled  by  an  error  threshold.  In  other  words,  given  an  error  c  and  a  threshold  level  5,  the 
system  is  switched  to  a  higher  gain  when  c  Z  i  and  is  switched  back  to  a  lower  gain  when  e  <  s.  Some 
modifications  have  been  introduced  to  this  criterion  to  reduce  the  effects  of  switching  transients,  but 
VICTOR-E  remains  intrinsically  a  switching  algorithm. 

To  retain  reasonable  levels  of  damping,  the  higher  gain  of  the  VICTOR  system  must  be  associated  with 
a  greater  bandwidth,  In  the  single-loop  VICTOR  systems  described  by  Gill  (Refs.  4,  5),  the  noise  filter 
time-constants  (and  hence  the  bandwidth  of  the  system)  are  slaved  to  the  gain  variation.  As  noted  earlier, 
however,  an  important  feature  of  the  VICTOR-E  implementation  is  the  parallel  structure  (Fig.  3),  in  which 
the  variable-gain  elements  are  confined  to  a  separate  loop.  One  advantage  of  this  parallel  architecture 
is  that  the  wider  bandwidth  of  the  VICTOR  loop  can  remain  fixed,  with  the  contribution  of  this  loop  being 
controlled  by  the  gain  term  alone,  and,  hence,  the  need  for  filter  time-constant  variation  is  removed. 

The  structure  of  the  VICTOR  control-loop  includes  variable  proportional  and  "leaky"  integral  control 
in  addition  to  fixed-phase  advance  and  noise  filter  elements.  The  overall  gains  are  varied  by  means  of 
VICTOR  gearings  Vq  and  Ve,  which  are  in  the  range  of  0  to  1  (for  VICTOR-E,  Vq  is  set  equal  to  V e ) ,  and 
the  maximum  gains  of  the  VICTOR  loop  are  set  by  parameters  GqV  and  Gbv.  For  the  design  case,  theintegral 
gain  Ge„  is  set  to  zero,  and  the  proportional  gain  Gqv  is  set  to  3.6  (equal  to  the  value  of  Gg  in 
the  baseline  loop).  The  time-constant  of  the  noise  filter  and  phase  elements  in  the  VICTOR  loop  advance, 
tNv,  is  set  to  0.0125.  Other  values  of  these  parameters  are,  however,  included  in  the  eight  systems 
selected  for  flight  (see  Sec.  2.7). 


2.6  Operation  of  VICTOR-E 
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The  VICTOR-E  algorithm  operates  by  means  of  an  error  signal  ev,  which  controls  the  Vq  gearing 
(0  i  Vq  <  1).  To  ensure  that  Vq  responds  quickly  to  the  pilot's  stick  movements,  ev  is  Based  on  the 
difference  between  the  pitch-rate  response  q  and  the  pilot  demand  qp.  The  error  is  then  filtered  and 
washed  out  to  eliminate  noise  and  steady-state  components,  finally  yielding  the  VICTOR  error  ev,  defined 
by 


(q  -  qD) 


(, .'v) 


Time-constant  values  of  Tj  =  10  and  t2  =  0.05  have  produced  satisfactory  control  behavior. 

Initially,  the  VICTOR  gearing  was  increased  by  switching  Vq  from  0  to  1  when  the  error  threshold  6  was 
exceeded.  To  smooth  out  differences  in  control  behavior  experienced  when  pilot  demand  is  close  to  the 
threshold,  however,  a  second  threshold,  51,  was  introduced  so  that  when  ev  is  increasing  and 
S  <  cv  <  then  Vq  =  (ev  -  6)/(S1  -  6). 

When  the  control  demand  has  been  satisfied  and  the  error  is  reduced  to  a  low  level,  the  VICTOR  algo¬ 
rithm  must  take  account  of  this  and  reduce  Vq  toward  zero.  Gill  (Refs.  4,  5)  finds  that  the  response  is 
sensitive  to  the  rate  of  reduction  of  the  gain,  and  that  it  is  important  to  ensure  that  the  gain  is  not 
reduced  too  rapidly.  Hence,  if  ev  is  decreasing,  the  maximum  value  of  Vq  is  held  until  ev  <  6,  after 
which  Vq  is  reduced  to  zero  linearly  with  time.  A  ramp  decay  time  of  2  sec  has  proved  to  be  suitable. 

The  operation  of  the  VICTOR-E  algorithm  is  illustrated  in  Fig.  5,  using  the  results  from  simulation 
studies  for  a  0.1-sec  lagged-step  pilot  input  of  1  deg/sec.  It  should  be  noted  that  in  the  example  shown, 
ev  does  not  reach  a  high  enough  level  to  force  Vq  to  its  limiting  value  of  unity. 

2.6  Parameter  Combinations  for  Flight  Tests 


Following  simulation  of  the  CADRE  control  laws  at  RAE  and  NASA,  eight  combinations  of  parameters  were 
identified  as  possible  candidates  for  flight  testing.  These  eight  functions  can  be  coimanded  from  a  mode- 
panel  on  the  ground;  they  allow  the  control  law  on  the  RAV  system  to  be  changed  without  leaving  real  time 
(see  Sec.  3).  The  eight  combinations  comprise  four  basic  systems,  with  two  values  of  the  lead-time  con¬ 
stant  on  the  pilot's  prefilter,  ra  =  0.2  or  0.6,  specified  for  each  (see  Sec.  2.3).  The  basic  systems  are 
as  follows. 


1.  Baseline:  Here  the  proportional  and  integral  gains  in  the  VICTOR  loop  Gq*-,  Gjv  are  set  to  zero, 
leaving  only  the  baseline  loop  in  operation.  Even  though  the  VICTOR  loop  is  ineffective,  the  gearing  Vq 
continues  to  vary  and  can  be  used  as  an  indication  of  system  performance  (see'Sec.  4).  The  baseline  sys¬ 
tems  are  numbered  5  and  6  with  ta  =  0.2  and  0.6,  respectively. 

2.  VICTOR  (design  gain):  For  this  case,  the  VICTOR  proportional  gain  Gqv  is  set  at  3.6,  with  the 
integral  gain  Ggv  again  set  at  zero.  This  corresponds  to  the  design  case  described  in  Ref.  9  and  is 
intended  to  give  an  enhanced  control  performance  over  that  of  the  baseline  system.  These  systems  are 
denoted  by  1  and  2,  corresponding  to  ta  *  0.2  and  0.6,  respectively. 

3.  VICTOR  (half  design  gain):  Here,  Gqv  is  set  at  1.8,  which  represents  half  the  design  value  of 
3.6.  This  case  was  included  to  allow  GqV  to  be  increased  progressively  from  zero  to  the  design  value. 
Systems  3  and  4  refer  to  this  control ler  wi th  xa  *  0.2  and  0.6,  respectively. 

4.  VICTOR  (emulation  of  baseline):  For  this  case,  the  baseline  system  is  degraded  by  halving  the 
gains  Gq  and  Ga  and  allowing  the  VICTOR  gains  GqV  and  Gav  to  make  up  the  deficit.  The  VICTOR  noise 
filter  time-constant  try  Is  reset  to  the  baseline  value  tv.  Systems  7  and  8  correspond  to  ia  =  0.2 
and  0.6,  respectively. 

2.7  Implementation  of  Control  Laws  in  FORTRAN 


The  control  laws  described  previously  in  this  section  have  been  converted  to  difference-equation  form 
and  specified  as  a  set  of  subroutines  written  in  standard  FORTRAN  IV.  One  of  the  principal  aims  of  the 
software  design  was  to  produce  well-commented,  easy-to-follow  coding,  to  ensure  that  the  programs  comprised 
an  exact  definition  of  the  computing  task  to  be  performed.  The  development  of  the  difference  equations 
used  in  the  software  is  described  in  more  detail  in  Refs.  14  and  15.  The  structure  of  the  software  is 
shown  in  Fig.  6.  Different  versions  of  the  coding  are  given  in  Refs.  8,  9,  and  12,  but  each  version  is 
referred  to  by  a  unique  one-  or  two-letter  identifier  xx.  With  reference  to  Fig.  6,  each  version  contains 
three  subroutines: 


1.  The  initialization  routine,  QINIxx,  is  called  once  before  engagement  to  set  up  the  system  param¬ 
eters  (gains  and  filter  coefficients,  etc.)  and  to  initialize  the  filters. 

2.  The  control  program,  QCONxx,  takes  in  pitch  rate  and  longitudinal  stick  position  and  generates  an 
elevator  demand  signal.  To  minimize  computing  time  delays  from  input  to  output,  this  routine  performs 
only  as  much  of  each  filter  calculation  as  is  needed  to  produce  the  output. 

3.  The  filter  completion  routine,  QFILxx,  completes  the  filter  calculations  ready  for  the  next  input 
sample. 
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3.  RAV  SYSTEM  OVERVIEW 

The  F-8C  DFBW  aircraft  contains  a  triply  redundant,  full-authority,  digital  fly-by-wire  flight- 
control  system  with  provisions  for  accepting  single-string  (simplex)  control-surface  cormands  from  a 
ground-based  computer  while  in  a  special  remotely  augmented  vehicle  (RAV)  mode.  This  mode  allows  advanced 
control  concepts,  such  as  the  CADRE  control  laws,  to  be  programmed  into  the  ground-based  computer.  The 
necessary  data  are  transmitted  to  the  ground  and  the  computer  commands  are  transmitted  back  to  the  air¬ 
craft,  as  shown  earlier  in  Fig.  1.  The  RAV  mode  is  selectable  by  the  pilot.  It  is  a  single-string 
(simplex)  system;  therefore,  if  there  is  any  failure,  the  system  automatically  switches  or  can  be  manu¬ 
ally  switched  back  to  the  on-board  digital  SAS  mode.  The  CADRE  RAV  mode  allows  implementation  and 
changes  to  the  CADRE  control  laws,  which  are  written  in  FORTRAN,  without  disrupting  the  integrity  of  the 
on-board  flight  system. 

In  addition  to  prograirmi ng  the  control  laws  in  the  ground-based  computer,  the  development  and  flight 
qualification  of  the  CADRE  system  involved  an  effort  in  system  development.  Significant  changes  and 
improvements  were  required  for  the  existing  ground  and  airborne  software.  Ref.  1,  for  the  CADRE  program. 
Additional  failure-detection  and  identification  methods  were  required  for  maneuvering  flight.  An  effort 
was  made  from  the  start  to  develop  a  failure  management  strategy  that  would  allow  full  elevator  authority 
during  maneuvering  while  allowing  no  failure  in  the  F-8C  RAV  system  to  compromise  either  the  fail- 
operational  integrity  of  the  triplex  on-board  systems,  or  the  flight  safety  of  the  aircraft. 

Monitoring  command  software  was  used  for  both  the  simulator  testing  and  during  flight.  This  allowed 
significant  time  saving  during  evaluation,  verification,  validation,  and  during  flight  testing. 

Although  the  rigorous  flight  qualification  standards  developed  in  previous  RAV  experiments  were  used, 
modifications  were  made  in  the  testing  techniques  and  the  procedures  to  meet  the  unique  requirements  of 
the  CADRE  system. 

3.1  CADRE  RAV  System 

The  CADRE  RAV  system  involved  mechanization  and  implementation  of  various  ground  and  airborne  hard¬ 
ware,  as  well  as  software  interfaces.  The  primary  elements  of  the  hardware  used  in  the  F-8C  RAV  facility 
are  shown  in  Fig.  7;  they  ar'  divided  between  ground  systems  and  airborne  systems. 

The  process  starts  with  parameters  being  downlinked,  including  aircraft  sensor  signals  and  pilot 
commands.  These  signals  are  received  at  the  telemetry-receiving  station  and  are  passed  to  a  downlink 
telemetry  computer  which  performs  the  required  subframe  decommutation  and  discrete  processing  of  the  down¬ 
link  data.  It  also  formats  a  data  buffer  for  access  by  the  control-law  computer.  The  downlink  data  are 
then  interfaced  to  the  CADRE  computational  algorithms  in  the  control-law  computer.  An  additional  computer 
interface,  shown  in  Fig.  7,  is  to  an  external  mode-control  box.  This  provides  a  flexible  change  to  the 
CADRE  control  laws  between  the  eight  different  control  algorithms. 

The  function  of  the  CADRE  control-law  computer  is  first  to  compute  the  CADRE  control  algorithms. 
Secondary  factions  are  real-time  input/output  computation,  fault  detection,  and  ground  preflight  testing. 
The  program  structure  has  two  primary  segments.  One  is  a  real-time  segment  which  is  synchronized  to  the 
uplink  encode,  and  operates  at  an  18.75-msec  frame  rate.  It  contains  all  elements  for  the  eight  CADRE 
control-law  configurations,  logic  for  switching  between  control  laws,  and  the  set  of  failure  detection  and 
isolation  algorithms  that  is  discussed  in  Sec.  2.  In  addition,  it  contains  the  input  and  output  routines 
required  for  the  reformatting  of  the  downlink  and  uplink  parameters  and  the  discrete  interface  to  the  mode- 
control  box.  The  other  segment  of  the  program  structure  is  the  non-real-time  or  background  segment.  All 
initialization  functions  and  several  display  routines  are  processed  in  this  segment.  The  display  routines, 
which  are  formatted  for  a  CRT  terminal,  were  designed  for  ground  checkout  and  testing.  In  addition,  the 
CRT  terminal  interface  allows  selected  control  system  parameters,  for  example,  GqV,  to  be  changed  during 
flight,  if  desired.  The  display  routines  permit  the  easy  monitoring  of  many  of  the  hardware-to-software 
interface  parameters,  internal  control  variables  and  states,  and  failure  detection  functions.  The  ground 
computer  software  also  contains  a  preflight  nodule  that  is  divided  into  static  checks  and  a  maximum/ 
minimum  dynamic  check.  The  CADRE  preflight  is  a  monitor-only  program;  therefore,  it  can  be  used  during 
flight  if  desired.  Hard  copies  may  be  obtained  of  not  only  the  preflight  tests  but  of  any  of  the  CRT 
displays. 

The  CADRE  control-law  uplink  conznands  are  formatted  as  four  16-bit  words  of  command  information  and 
operate  on  an  18. 75-msec  frame  rate.  Each  command  word  contains  10  bits  of  proportional  information;  the 
remaining  six  bits  are  used  for  discrete  uplink  signals  which  provide  for  ground-conmanded  RAV  disengage¬ 
ment.  Although  the  RAV  program  uplinks  the  four  words  pitch  cormand,  roll  command,  you  cormand,  and  flap 
cormand,  the  CAORE  system  only  uses  the  pitch  command.  The  uplink  decoder  outputs  the  four  digital  uplink 
words,  which  are  then  interfaced  to  the  on-board  flight-control  system.  The  RAV  conmands  are  also  sent  to 
the  on-board  instrumentation  system  and  transmitted  via  the  downlink  telemetry  for  monitoring  in  ground- 
based  facilities  during  flight.  The  CADRE  RAV  system  interface  to  the  on-board  flight  system  was  designed 
to  be  an  independent,  pilot-selectable  mode.  Special  care  was  taken  to  ensure  that  the  operation  of  the 
CAORE  RAV  mode  did  not  compromise  the  overall  redundancy  management  and  failure  strategies  of  the  DFBW 
flight  systems.  Therefore,  the  RAV  on-board  computer  software  mechanization  included  a  series  of  logic 
statements  specifying  the  conditions  for  the  engagement  and  disengagement  nf  the  CADRE  RAV  mode;  these  are 
discussed  in  detail  in  Sec.  3.2. 

In  addition  to  pilot  selection  of  the  CADRE  control  modes,  all  of  the  engagement  conditions  had  to  be 
satisfied  before  the  CADRE  RAV  mode  became  suitable  for  flight  testing.  The  CADRE  system  was  automatically 
disengaged,  and  control  was  transferred  to  the  on-board  SAS,  if  any  of  the  disengage  conditions  appeared. 

In  addition,  the  RAV  on-board  software  contained  functions  that  provided  transient-free  mode  engagement, 
and  command-rate  reasonability  checks.  The  on-board  computer  software  was  also  modified  to  include  com¬ 
mand  authority  floating  limits  and  ultimate  g  limits.  This  allows  full  elevator  authority  for  maneuvering 
flight,  which  was  needed  for  CADRE  flight-test  evaluation,  while  providing  aoditional  on-board  protection. 


The  authority  limits  and  rate-check  thresholds  were  all  chosen  to  ensure  that  aircraft  transients  were 
acceptable  in  the  event  of  a  worse-case  hardover  failure. 

3.2  Failure  Detection  and  identification 
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The  CADRE  experiment  was  designed  using  a  single-string  (simplex)  RAV  system;  therefore,  redundancy 
management  algorithms  commonly  used  for  multiple  systems  were  impossible.  Although  a  previous  RAV  system 
had  successfully  been  developed  (Ref.  1),  it  was  not  a  full-authority  system  and  did  not  require  some  of 
the  additional  concepts  developed  for  this  program.  The  primary  features  of  the  CADRE  RAV  mode-failure- 
detection  system  are  (1)  continuous  rate-check  testing  of  the  uplink  and  downlink  signals  every  minor 
cycle  by  both  the  flight  and  ground  computers;  (2)  inhibition  of  RAV  engagement  until  certain  criteria  are 
satisfied  for  both  computer  systems;  (3)  a  wrap  test  that  compares  the  RAV  uplink  command  with  itself  sent 
back  on  a  downlink  word;  (4)  use  of  a  floating  window  command  limiter  in  the  flight  computer;  and 
(5)  imposition  of  a  g  envelope  boundary  for  RAV  operation.  If  a  hard  failure  is  declared  by  either  com¬ 
puter  system,  a  RAV  downmode  automatically  occurs  whereby  the  RAV  conrnand  is  faded  to  the  on-board  command 
in  2  sec.  The  particular  cause  of  the  RAV  downmode  is  immediately  identified  and  displayed  in  real  time 
for  downmodes  originating  from  the  ground  computer.  Piloted  action  is  required  to  activate  the  RAV  fail¬ 
ure  display  code  for  RAV  disconnects  originating  in  the  flight  computer,  and  that  information  is  then 
relayed  to  the  flight  controller.  The  failure  detection  tests  and  RAV  limiting  restrictions  will  now  be 
discussed. 

Ground  computer-  There  are  11  tests  for  failure  monitoring: 


1. 

RAV  engagement  bias 

7. 

DECL  downlink  rate  check 

2. 

DEUP  rate  check 

8. 

DFRAV  downlink  rate  check 

3. 

Stick/trim  opposition 

9. 

DYr.i  downlink  rate  check 

4. 

Wrap  test 

10. 

Downlink  telemetry  computer  fail 

5. 

DEP  downlink  rate  check 

11. 

CADRE  control-law  computer  fail 

6. 

Q  downlink  rate  check 

Failure  identification  is  displayed  in  real  time  both  on  a  strip  chart  and  on  a  light  display  on  the  mode- 
control  panel.  Since  the  RAV  mode  is  susceptible  to  data  spikes  caused  by  temporary  loss  of  the  telemetry 
signal,  a  hard  failure  is  not  declared  unless  a  threshold  has  been  exceeded  for  n  or  more  consecutive 
iterations.  Once  a  RAV  downmode  is  commanded,  the  error  must  be  reset  before  another  RAV  attempt  is  made. 
Each  test  will  now  be  described. 

Before  RAV  engagement,  the  CADRE  conrnand  is  compared  with  the  current  SAS  conrnand.  The  difference 
between  the  two  must  be  5°  or  less,  otherwise  an  engagement  bias  error  is  declared  that  inhibits  the  RAV 
mode  from  engagement.  Ar.y  conrnand  difference  less  than  5°  is  added  to  the  CADRE  conrnand  which  then  forms 
the  RAV  uplink  command  (DEUP),  This  bias  then  becomes  fixed  upon  a  successful  RAV  engagement. 

Rate-check  testing  is  performed  on  the  CADRE  RAV  uplink  signals.  If  the  conrnand  rate  exceeds  the 
rate-check  limit,  the  current  command  is  replaced  with  the  previous  one  and  a  counter  starts  incrementing. 

As  long  as  this  condition  exists  the  RAV  command  remains  frozen  until  the  counter  limit  is  reached  and  a 
RAV  dowrmoHo  is  declared.  If  the  RAV  command  becomes  less  than  the  rate-check  value  before  the  counter 
limit  i.  ...bed,  the  RAV  conrnand  is  allowed  to  update  to  the  new  value,  and  the  counter  is  reset  to  zero. 

A  test  is  performed  that  determines  whether  the  trim  conrnand  is  in  the  same  direction  as  the  stick 
displacement.  If  the  stick  deflection  exceeds  the  threshold,  and  a  trim  command  is  in  opposition,  a 
counter  starts  incrementing.  When  the  counter  limit  is  reached,  a  RAV  downmode  is  declared. 

A  wrap  test  performs  a  closed-loop  check  of  the  RAV  uplink  conrnand  with  itself  which  is  sent  back  on 
a  downlink  channel.  If  the  difference  between  these  signals  exceeds  a  given  tolerance,  a  counter  starts 
incrementing.  When  the  counter  limit  is  reached,  a  RAV  downmode  is  commanded. 

The  proportional  downlink  words  are  rate-checked  in  their  raw  PCM  format  form  before  they  are  converted 
to  engineering  units.  If  the  rate  of  change  exceeds  the  tolerance  level,  the  previously  passed  signal 
replaces  the  current  one  and  a  counter  starts  incrementing.  As  long  as  this  condition  exists,  the  passed 
signal  remains  frozen  until  the  counter  reaches  a  limit,  at  which  time  a  RAV  downmode  is  commanded.  If  the 
input  signal  becomes  less  than  the  tolerance  before  the  counter  limit  has  been  reached,  the  new  signal  will 
be  passed  through,  and  the  counter  will  be  reset  to  zero. 

The  discrete  downlink  word  is  tested  in  a  different  way.  For  any  discrete  change  to  be  recognized  it 
must  exist  for  at  least  three  consecutive  iterations;  if  not,  the  change  is  ignored,  although  no  RAV  down¬ 
mode  will  result.  This  logic  produces  a  two-sample  delay  for  all  discrete  changes. 

The  downlink  telemetry  computer  that  first  receives  the  downlink  signals  is  tested  in  the  following 
way.  The  computer  expects  to  receive  fresh  downlink  data  at  a  rate  of  200  sps,  and  when  it  does,  a 
counter  is  incremented.  If  the  counter  fails  to  advance  fir  five  consecutive  iterations,  a  RAV  downmode 
is  commanded. 

The  control -law  computer  1-  tested  for  failures  by  use  of  an  external  hardware  watchdog  timer.  Each 
time  the  real-time  loop  begins  execution,  a  pulse  is  sent  to  a  timer.  Failure  to  receive  another  pulse 
within  about  20  msec  causes  a  time  out  and  a  RAV  downmode  will  be  cotimanded  through  hardware 

Flight  computer-  There  are  15  conditions  that  must  be  satisfied  by  the  flight  computer  in  order  to 
engage  the  RAV  mode  and  to  stay  in  that  mode.  These  conditions  are  as  follows: 
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Not  in  SAS  mode 

Surface  rate  check 

Not  SAS  and  surface  rate  check 

Engage  tolerance  failed 

Flap-engage  tolerance  failed 

Flap  rate  check 

Not  SAS  and  flap-rate  check 

Surface  and  flap-rate  check 


Not  SAS,  surface  and  flap-rate  check 

Kutopilot  engaged 

Autopilot  disconnect 

Sensor  failed 

Uplink  failed 

Low-g  limit  exceeded 

H'  ;h-g  limit  exceeded 


The  display  codes  are  accessible  to  the  pilot  upon  his  request  to  execute  the  RAV  failure  display  code 
program.  The  major  failure  testing  will  now  be  discussed. 

A  RAV  engage  tolerance  test  is  first  performed.  It  looks  at  the  current  RAV  uplink  command  and  com¬ 
pares  it  with  the  present  on-board  cormand.  They  must  be  within  1°  for  this  test  to  pass,  otherwise  a 
RAV  inhibit  error  will  be  set  to  prevent  an  engagement. 


Unce  the  RAV  mode  has  been  engaged,  the  command  is  rate  checked.  This  test  is  similar  to  that  of  the 
RAV  rate-check  test  which  is  done  in  the  ground  computer.  If  the  rate  of  change  of  the  RAV  coimand  exceed' 
50'7sec,  the  current  RAV  command  is  replaced  with  the  previous  one  until  the  counter  reaches  the  limit  of  3. 
When  this  situation  occurs,  a  RAV  downmode  is  declared  from  the  airborne  computer. 


A  floating  window  command  limiter  was  added  to  the  airborne  software  for  the  CADRE  RAV  program  as  a 
final  test  to  prevent  an  undetected  handover  just  below  the  rate  check  from  coming  through  to  the  surface 
directly.  This  limiter  is  illustrated  in  Fig.  8.  Initially,  the  window  is  centered  at  ±3"  coout  the  cur¬ 
rent  RAV  command.  Command  rates  up  to  507sec  are  allowed  within  the  6°  window.  The  window  continuously 
tries  to  stay  centered  on  the  RAV  command,  but  is  only  allowed  to  drift  at  a  maximum  rate  of  2.5Vsec. 
Eventually,  the  RAV  command  will  be  rate-limited  to  the  drift  rate  value  until  the  command  rate  is 
decreased  or  reversed  and  the  window  is  allowed  to  recenter  as  shown  in  the  figure.  A  rate- limit  signal 
is  telemetered  to  the  control  room  during  the  flight  test  whenever  the  RAV  command  is  rate- 1 imi ted. 

The  floating  limiter,  in  combination  with  the  rate-check  testing  that  is  resident  in  the  triply  redun¬ 
dant  on-board  systems,  provides  protection  for  a  full-authority,  single-string  (simplex),  ground-based 
control  system.  However,  because  of  other  safety  considerations,  RAV  operation  at  the  outer  airplane 
g  limits  was  deemed  undesirable.  Therefore,  a  g  envelope  limit  for  RAV  operation  was  also  added  to  the 
airborne  system.  These  limits  were  set  at  +5  and  -2  g’s.  If  these  limits  are  exceeded,  an  automatic  RAV 
downmode  will  result. 


3.3  RAV  Software  Development 

Simulation-  The  CADRE  control  laws  were  developed  by  RAE  and  supplied  to  NASA  DFRF.  The  simulation 
developments  at  NASA  DFP.F  were  performed  in  two  principal  stages.  The  first  stage  involved  development 
of  a  real-time,  all-dig'tal  simulation  of  the  CADRE  system  -  a  duplication  of  the  system  developed  by  RAE. 
Data  supplied  by  RAE  were  used  to  validate  the  simulation.  This  allowed  for  consistency  checking  between 
results  and  provided  a  timely  method  for  evaluating  modifications  to  individual  control  system  filters  or 
combinations  of  filters  for  selected  inputs. 

The  second  stage  was  the  major  simulation  effort;  it  consisted  of  a  CADRE  simulation  using  the  F-8C 
DFBW  iron-bird  simulation  facility  (Fig.  9).  The  iror-bird  simulation  consists  of  a  decommissioned  F-8C 
aircraft  with  the  following  equipment:  triplex  primary  digital  system;  triplex  analog  computer  bypass;  a 
full  set  of  flight  actuators;  triplex  electrical  buses  with  batteries;  triplex  hydrau’ic  system;  operable 
auxiliary  aircraft  systems;  and  operable  cockpit  instruments. 

The  iron  bird  interfaces  with  a  nonlinear  simulation  of  the  F-8C  aerodynamics  which  uses  actual  sur¬ 
face  positions  as  inputs.  The  RAV  ground  computers  were  used  as  elements  of  the  total  CADRE  simulation. 

The  uplink  and  downlink  hardware  interfaces  were  simulated  in  the  simulation  computer,  and  the  control 
laws  were  implemented  on  the  same  type  of  ground  computer  that  was  used  during  flight. 

The  iron-bird  facility  was  the  key  element  in  the  system  verification,  validation,  and  flight 
qualification. 

CADRE  aoftuore  verification-  The  CADRE  software  verification  tests  were  designed  to  insure  compliance 
with  the  software  specification.  The  verification  process,  which  included  element-by-element  verification, 
required  written  procedural  descriptions  and  produced  hard-copy  test  results.  All  dynamic  elements,  such 
as  filters,  were  exercised  in  a  dynamic  environment,  and  responses  were  compared  with  independent  computer 
responses  based  on  the  desired  characteristics.  All  path  combinations  of  the  CADRE  control  laws  were 
executed.  Each  test  was  accompanied  by  a  written  verification  test  report  that  is  under  software  control 
management.  These  reports  contain  descriptions  of  test,  objective,  setup,  results,  and  conclusions. 

A  .prehensive  software  configuration  control  policy  was  developed  based  on  the  previous  RAV  experi¬ 
ence  (Ref.  1).  Procedures  were  implemented  to  jovern  the  verification  test  requirements,  software  changes, 
discreoancy  reporting  and  reconciliation,  software  manufacture  and  loading,  and  documentation  requirements. 

Not  only  were  written  verification  tests  and  results  required,  as  discussed  above,  but  all  program 
changes  also  required  the  same  documentation,  before  the  implementation  of  any  program  change,  approval 
had  to  be  given  by  a  software  control  board. 

CADRE  configuration  validation-  The  overall  CADRE  system,  configuration  testing  was  designed  to  qualify 
the  CADRE  ground  and  vehicle  systems  and  to  insure  proper  system  operation.  The  analysis  and  validation  of 
the  basic  system  design  and  mechanization  initially  used  the  iron-bird  simulation.  This  facility  was  used 
to  verify  the  proper  control-law  implementation  through  static  and  dynamic  response  tests  and  through 
extensive  piloted  evaluation.  The  RAV  ground  computer  was  used  as  elements  of  the  total  simulation,  and 
the  uplink  and  downlink  hardware  interfaces  were  simulated.  The  RAV  simulation  ground  and  on-board 


software  interfaces  were  identical  to  those  of  the  actual  aircraft  and  ground  facilities,  and  the  software 
developed  and  validated  in  the  CADRE  system  simulation  was  used  during  the  CADRE  flight  operation. 

Qualification  testing-  A  series  of  failure-mode  demonstration  tests  was  conducted  to  insure  proper 
system  response  to  any  critical  fault.  These  tests  were  first  conducted  on  the  F-8  iron-bird  simulator, 
then  a  subset  of  these  tests  was  repeated  during  aircraft/ground  facility  systems  tests.  In  addition,  an 
integrated  closed-loop  preflight  of  the  total  CADRE  system  was  accomplished  in  which  all  CADRE  input  and- 
output  parameters  were  checked  both  statically  and  dynamically.  As  a  final  step  in  the  flight  qualifica¬ 
tion  process,  the  RAV  system  operational  parameters  were  monitored  during  a  sequence  of  flight  tests  in 
which  the  CADRE  control  laws  were  operating  open-loop.  These  open-loop  monitoring  flight  tests  verified 
RAV  uplink  and  downlink  communication  links,  telemetry  signal  strength,  and  the  ground  and  aircraft  syn¬ 
chronization  strategies. 


4.  FLIGHT  TESTS 

Flight  tests  of  the  VICTOR  variable-gain  control  laws  commenced  in  February  1982.  The  main  objective 
of  the  tests  was  to  establisn  whether  the  variable-gain  controller  could  offer  improved  control  performance 
over  that  of  a  fixed-gain  baseline  system  and  whether  any  adverse  handling  problems  were  introduced  by  the 
rapidly  varying  gains.  In  addition,  a  comparison  has  also  been  made  between  the  baseline  controller  and  a 
variable-gain  system,  designed  to  reproduce,  rather  than  improve,  the  performance  of  the  baseline.  The 
task  usee  for  this  assessment  has  been  an  air-to-air  tracking  task,  in  which  the  F-8C  pilot  is  required  to 
track  an  accompanying  chase  aircraft  through  a  pushover/pull-up  maneuver.  Details  of  the  maneuver  and 
other  test  procedures  are  given  in  Sec.  4.1.  No  direct  measurement  of  the  accuracy  of  tracking  is  avail¬ 
able,  but  indirect  indications  are  obtained  from  recordings  of  the  system  activity  and  from  pilot  ratings 
of  the  different  controllers.  These  results  are  presented  in  Sec.  4.2. 

The  initial  flight  tests  have  highlighted  the  nee<j  for  some  enhancements  of  the  current  variable-gain 
control  laws.  Improvements  planned  include  the  provision  of  gain  scheduling  with  dynamic  pressure  to  widen 
the  flight  envelope,  and  the  introduction  of  a  rate-limiting  term  in  the  variable-gain  logic  to  alleviate 
the  effects  of  transient,  rapid  increases  in  gain,  which  can  lead  to  the  RAV  rate  limit  being  exceeded  and 
to  a  consequent  RAV  downmode.  Following  this,  it  is  proposed  that  three  further  concepts  that  have  been 
studied  at  RAE  be  introduced  into  the  CADRE  control  laws.  These  are  (1)  overshoot  control  (Ref.  5),  in 
which  the  damping  properties  of  the  control  loop  are  adjusted  during  the  response  to  prevent  undesirable 
overshoots;  (2)  a  nonlinear  contnand  prefilter  (Ref.  16),  which  is  designed  to  give  good  response  for  both 
target  acquisition  and  tracking;  and  (3)  the  self-adaptive  technique,  INFAIR  (Ref.  17),  in  which  the  param¬ 
eters  of  the  compand  prefilter  are  adjusted  to  maintain  invariant  control  response  across  the  flight 
envelope.  Some  of  these  developments  are  discussed  in  Sec.  4.3. 

4.1  Test  Prccedv-e 

During  the  CADRE  flight-test  program,  the  F-8C  takes  off  and  climbs  to  the  design  conditions,  normally 
Mach  0.6  and  an  altitude  of  6100  m,  with  the  on-board  stability  augmentation  system  (SAS)  engaged  in  pitch, 
roll,  and  yaw.  After  trimming  the  aircraft,  the  pilot  engages  the  RAV  pitch  mode,  thus  allowing  the  longi¬ 
tudinal  control  to  be  provided  by  the  experimental  CADRE  control  laws  on  the  RAV  ground  computer. 

The  initial  tests  included  testing  of  the  eight  CADRE  control  modes  and  the  longitudinal  SAS  mode 
under  the  following  conditions: 

1.  Nose-up  and  nose-down  pitch  pulses  input  by  the  pilot 

2.  Steps  input  by  ground  control 

3.  Rapid  climb  and  descent  between  5500  and  6700  m 

4.  3-g  windup  turn 

These  tasks  were  used  primarily  to  allow  both  the  pilot  and  flight-test  personnel  to  evaluate  the 
control-law  performance  from  a  stability  standpoint  before  the  pilot  rated  its  ability  to  perform  the 
required  task. 

The  major  part  of  the  flight  test  has  been  devoted  to  an  evaluation  of  the  CADRE  controller  for  an 
air-to-air  tracking  ta:>x  in  which  the  F-8C  pilot  attempts  to  track  the  accompanying  chase  aircraft  through 
a  maneuver.  In  this  maneuver,  the  pilot  of  a  target  aircraft  rolls  into  a  stabilized  3-g  turn  while  endeav¬ 
oring  to  keep  the  designed  altitude  and  speed  condition,  but  allowing  altitude  loss,  if  necessary.  After 
turning  180°,  the  target  pilot  unloads  the  aircraft,  reverses  the  direction  of  roll  and  pulls  a  stabilized 
3  g's  in  the  opposite  direction,  again  through  180°.  A  tracking  distance  of  about  300  m  has  been  used  to 
allow  assessment  of  low  overshoot  CADRE  controllers  l,  3,  5,  and  7. 

For  this  tracking  task,  the  F-8C  pilot  was  asked  to  assign  a  Cooper-Harper  pilot  rating  (Ref.  18); 
this  rating,  as  well  as  any  other  pilot  comments  on  the  system,  was  recorded.  In  general,  the  pilot  was 
not  told  which  CADRE  controller  was  in  operation.  On  the  flight  instruction  card,  the  different  control¬ 
lers  were  simply  referred  to  as  modes  A,  B,  C,  etc.,  with  the  relationship  to  the  CADRE  controllers 
(1  to  8)  known  only  to  the  flight-test  engineers.  This  enabled  the  inclusion  of  repeat  points  to  estab¬ 
lish  whether  the  pilot  rating  changed  during  the  course  of  a  flight. 

Although  more  complex  tracking  tasks  have  been  attempted,  they  have  usually  led  to  a  RAV  downmode 
because  of  the  elevator  rate  of  g-limit  checks.  It  is  possible  that  the  inclusion  of  a  rate-limit  con- 
trolW  and  gain  scheduling  (Sec.  4.4)  within  the  CADRE  control  laws  will  allow  the  more  complex  tracking 
task-,  to  be  achieved. 
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4.2  Flight  Results 

The  initial  flight  tests  concentrated  on  the  tracking  tasks  described  in  Sec.  4.1,  with  the  target 
aircraft  at  a  range  of  about  300  m.  The  control  laws  that  are  designed  for  the  task  are  modes  1,  3,  5, 
and  7.  For  these  modes  the  lead-time  constant  on  the  pilot's  prefilter  is  set  at  0.2,  giving  a  relatively 
low  overshoot  (Sec.  2.3).  The  controller,  with  =  0.6  (cases  2,  4,  6,  and  8),  giving  an  overshoot  in 
pitch  rate  have  also  been  flown  for  this  task,  but  have  usually  been  given  lower  ratings.  A  summary  of 
the  ratings  of  two  pilots  (pilots  A  and  B)  for  the  eight  CADRE  controllers  defined  in  Sec.  2.7,  together 
with  the  on-board  SAS  system,  is  given  in  Table  1.  The  ratings  in  the  table  are  for  two  particular 

flights  but  they  are  representative  of  ratings  assigned  after  all  five  flights  to  date.  The  SAS  mode  uses 

washed  out  pitch-rate  feedback  to  improve  the  short-period  damping;  since  it  is  implemented  on  the 
on-board  system,  no  additional  RAV  time  delay  is  involved. 

From  Table  1,  it  can  be  seen  that  the  pilots  have  consistently  rated  the  mid-gain  VICTOR  system 
(mode  3)  higher  than  the  other  CADRE  controllers.  Some  basis  for  this  rating  can  be  found  in  Fig.  10 

where  flight  records  for  the  tracking  maneuver  for  case  5  (baseline)  and  case  3  are  compared.  First,  from 

the  pilot  input  traces  of  Fig.  10a,  it  can  be  seen  that  the  pilots  were  able  to  reproduce  the  maneuver 
very  accurately,  in  that  the  variation  of  pitch-rate  demand  with  time  is  virtually  identical  for  the  two 
modes.  The  low-amplitude,  high-frequency  bursts  on  the  elevator  demand  signal  for  mode  3  of  Fig.  10b 
show  the  influence  of  the  VICTOR  loop  in  widening  the  bandwidth  of  the  controller.  That  the  extra  band¬ 
width  is  significant  can  be  judged  from  the  pilot  ratings  and  a  comparison  of  the  VICTOR  gearing  ( VQ )  time 
histories  of  Fig.  10c.  The  activity  of  the  VICTOR  gearing  is  a  convenient  measure  of  hjw  well  the  control 
demand  is  being  satisfied,  since  the  gearing  increases  toward  unity  when  the  difference  between  demand  and 
response  exceeds  a  prescribed  threshold.  In  the  traces  of  Fig.  10c,  the  VICTOR  gearing  is  below  one  for 
a  considerably  greater  part  of  the  maneuver  in  case  3  than  in  case  5,  indicating  the  greater  degree  of 
control  afforded  by  the  VICTOR  controller. 

Further  observations  of  the  different  controllers  in  the  tracking  task  and  pilot  comments  about  them 
are  sumnarized  below. 

1.  Baseline  system  (case  5):  Generally,  the  baseline  pitch-rate  controller  was  rated  slightly  better 
than  the  on-board  SAS  controller.  Control  was  precise  and  stable,  but  the  initial  response  to  a  stick 
input  was  thought  to  be  rather  slow.  The  pilot  rating  was  4  to  5. 

2.  High-gain  VICTOR  system  (case  1):  There  were  stability  problems  with  the  design  case  (case  1)  of 
VICTOR.  In  particular,  the  short-period  mode  was  poorly  damped  and  any  attempt  to  use  this  controller  for 
tracking  led  to  a  rate  limit  and  a  RAV  downmode.  The  inadequate  damping  for  this  case  was  due  to  the  time 
delay  in  flight,  which  has  been  estimated  at  about  100  msec.  This  was  greater  than  the  50-msec  delay  used 
in  the  original  design.  It  is  anticipated  that  the  performance  of  this  controller  will  be  improved  by  the 
introduction  of  rate  limit  and  overshoot  control  elements.  These  are  discussed  in  Sec.  4.3.  No  pilot 
ratings  were  given  because  of  the  stability  problems. 

3.  Mid-gain  VICTOR  system  (case  3):  In  general,  this  controller  was  preferred  for  the  tracking  task, 

giving  precise  control  with  at  most  one  overshoot.  A  consistent  pilot  rating  of  3  was  obtained  and  flight 
traces  indicate  that  the  error  between  demand  and  response  was  usually  smaller  than  with  the  other  systems, 
with  the  result  that  the  VICTOR  loop  was  active  for  less  time  (see  Fig.  10).  One  test  has  been  performed 
with  gain  between  the  mid-  and  high-gain  system,  cases  3  and  1.  Indications  are  that  there  is  an  improve¬ 
ment  in  pilot  rating  from  3  to  2  for  small  increments  in  maximum  variable  gain  (Gqv  *  2.2).  This  may  imply 

that  an  optimal  value  of  GqV  may  be  determined,  given  the  present  system. 

4.  VICTOR  emulation  of  baseline  (case  7);  The  pilot  rating  for  this  case  was  similar  to  that  for  the 

baseline  (case  5).  Nevertheless,  the  pilots  could  detect  a  difference  between  the  two  controllers,  in  that 
case  7  was  thought  to  give  less  precise  control,  with  slightly  lower  damping  than  the  baseline.  (In  fact, 

the  damping  levels  for  cases  7  and  5  are  the  same;  therefore,  the  perception  of  lower  damping  levels  may  be 

the  start  of  a  PIO  as  the  pilot  reacts  to  the  controller  breaking  out  from  the  low-gain  condition.)  Flights 
are  planned  with  different  values  of  the  threshold,  which  will  give  further  information  on  this  effect. 

5.  System  with  pitch-rate  overshoot  (cases  2,  4,  6,  and  8):  These  systems  were  designed  for  tracking 
at  a  range  of  under  150  m,  but  have  been  assessed  in  the  300-m  tracking  task.  It  can  be  seen  from  Table  1 
that  the  pilot  ratings  are  less  consistent  and  more  adverse  for  their  controllers  than  the  low  overshoot 
modes.  Pilot  comments  would  seem  to  show  some  influence  of  the  time  delay  in  that  the  systems  appeared  to 
give  very  little  reaction  initially  followed  by  a  sudden  rapid  response  which  did  not  find  favor  with  the 
pilots.  For  close-range  tracking,  this  effect  may  not  be  so  pronounced,  since  the  task  is  governed  by 
height  changes  which  tend  to  lag  the  pitch-attitude  changes.  These  will  be  evaluated  in  future  flight 
tests,  using  a  simulated  refueling  task. 


5.  FURTHER  DEVELOPMENTS 

t-hancements  to  the  CADRE  controller  to  be  introduced  in  the  near  future  are  described  below.  These 
are  concerned  with  gain  scheduling,  rate-limit  control,  and  the  reduction  of  overshoots. 

5.1  Gain  Scheduling 

The  CADRE  controllers  were  designed  for  a  fixed  flight  condition  (Mach  0.67  at  6100  m).  During  the 
pushover/pull-up  tracking  maneuver,  the  pilots  experienced  some  difficulty  in  maintaining  the  design  condi¬ 
tions,  with  the  result  that  as  Mach  number  increased  or  altitude  decreased,  some  loss  of  stability  was 
experienced.  To  overcome  this  problem,  the  closed-loop  gains  are  to  be  scheduled  with  the  reciprocal  of 
the  measured  dynamic  pressure  q,  so  that  as  altitude  decreases  or  Mach  number  increases,  the  gains  will 
reduce  and  stability  will  be  restored.  A  scheduling  relationship  for  the  closed-loop  gain  Ga  and  tor 
the  feed-forward  gain  Ka  (Fig.  4),  has  been  selected  and  is  being  incorporated  in  the  CADRE  software. 
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5.2  Rate-Limit  Control 

One  of  the  safety  checks  incorporated  in  the  RAV  system  ensures  that  control  reverts  to  the  on-board 
system  should  the  demand  to  the  elevator  exceed  a  certain  rate  (Sec.  3).  This  has  proved  a  limiting  factor 
in  testing  some  of  the  CADRE  controllers,  particularly  the  high-gain  VICTOR  systems  (1  and  2).  Further 
design  studies  have  shown  that  the  high  rate  of  change  within  the  VICTOR  loop  is  due  mainly  to  the  rapid 
increase  in  the  gearing  Vq  associated  with  an  increase  in  control  demand.  In  fact,  the  successful  oper¬ 
ation  of  the  variable-gain  controller  is  not  significantly  affected  by  these  high  rates  and  hence  a  form 
of  rate-limit  control  can  be  introduced  with  little  or  no  performance  penalty.  In  Ref.  19,  several  alter¬ 
native  rate-limiting  strategies  are  compared  for  both  fixed-  and  variable-gain  controllers.  The  schemes 
proposed  are  based  on  continuous  representations  of  the  control  system  and  require  an  estimation  of  the 
extent  to  which  the  rate-limit  is  exceeded,  so  that  the  effective  gain  can  be  reduced  by  using  an  appro¬ 
priate  feedback  whenever  rate  limiting  is  imminent.  However,  for  an  implementation  such  as  that  used  in 
CADRE,  a  relationship  between  the  variable  gearing  Vq  and  the  demanded  control  rate  exists,  so  that  the 
rate  of  control  can  be  limited  by  adjusting  Vq  directly. 

5.3  Overshoot  Reduction 

A  nonlinear  technique  for  reducing  the  magnitude  of  response  overshoots  has  been  proposed  recently 
(Ref.  5).  It  is  based  on  the  argument  that  when  the  control  is  reducing,  the  magnitude  and  rate  of  change 
of  this  error  can  be  used  to  predict  a  possible  overshoot.  In  such  a  case,  an  additional  control  term  can 
be  introduced  to  increase  the  effective  damping.  The  dramatic  effect  of  such  a  term  is  shown  in  Fig.  11, 
where  the  technique  is  applied  to  the  high-gain  VICTOR  system  (case  1)  with  a  time  delay  of  100  msec.  It 
can  be  seen  that  the  undesirable  oscillatory  response  is  much  reduced,  without  a  significant  effect  on  the 
initial  rate  of  response  when  the  overshoot  control  term  is  introduced.  It  is  expected  that  the  influence 
of  the  time  delay  will  be  crucial  in  this  application,  with  an  effect  not  only  on  the  damping  of  the  sys¬ 
tem  but  also  on  the  timing  of  the  overshoot  control  term.  Figure  11  also  illustrates  the  effect  of  rate- 
limit  control,  with  the  onset  of  the  overshoot  control  switch  held  back  to  ensure  that  the  elevator  demand 
rate  does  not  exceed  SO^/sec. 

5.4  F-8C  RAV  Facility 

One  current  constraint  associated  with  the  RAV  facility  is  the  time  delay  introduced  by  the  telemetry 
coirmuni cation  with  the  ground-based  computer.  The  RAV  system  mechanization  for  future  programs  will  have 
significantly  less  delay.  Improvements  in  the  uplink  hardware  systems  provide  at  least  a  tenfold  increase 
in  system  bandwidth,  as  well  as  an  uplink  and  downlink  synchronization  capability.  These  features  will 
allow  the  RAV  time  delay  to  be  reduced  to  a  minimum. 


6.  CONCLUDING  REMARKS 

A  major  benefit  of  the  NASA  Dryden  F-8C  remotely  augmented  vehicle  (RAV)  facility  is  a  reduction  in 
the  resources  required  to  implement  experimental  control  laws  in  the  flight-test  program,  since  the  safe¬ 
guards  built  into  the  facility  obviate  the  need  to  produce  flight-critical,  high-integrity  software.  Fur¬ 
thermore,  the  control-law  software  is  written  in  a  high-level  language  (FORTRAN)  and  the  structure  and 
logic  are,  therefore,  readily  understood  by  the  engineers  and  scientists  working  on  the  program.  Addi¬ 
tional  safeguards  introduced  to  the  RAV  facility  for  the  NASA/RAE  CADRE  program  have  proved  very  successful 
in  widening  the  maneuver  envelope  of  the  aircraft,  while  maintaining  a  low  level  of  uncommanded  reversions 
to  the  on-board  system. 

The  additional  time  delay  associated  with  the  current  RAV  facility  did  influence  both  the  stability 
and  handling  assessment  of  the  experimental  control  laws.  Nevertheless,  meaningful  results  can  be  obtained 
by  comparing  the  behavior  of  different  control  laws  when  the  time  delay  is  present. 

The  initial  stage  of  the  CADRE  program  has  successfully  illustrated  the  potential  of  variable-gain 
control  laws,  which  allow  the  closed-loop  gains  to  rise  transiently  to  levels  that  would  not  be  desirable 
for  continuous  operation  owing  to  excessive  noise-induced  actuator  activity.  As  a  result  of  experience 
gained  during  the  first  stage  of  flight  experiments,  the  introduction  of  improvements  to  the  variable-gain 
control  laws  and  the  inclusion  of  further  nonlinear  techniques  developed  by  RAE  are  planned  in  the  near 
future. 
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TABLE  1.  SUMMARY  OF  PILOT  RATINGS  FOR  AIR-TO-AIR  TRACKING  TASK 


Rating 

Pilot  A  Pilot  B 

On  board 

SAS 

Stability  augmentation  system;  no 
time  delay 

5-6  5 

Low  overshoot  controllers 

Basel ine 

CADRE  baseline  controller 

4  5 

VICTOR 

High-gain  variable-gain  controller 

-- 

VICTOR 

Mid-gain  variable-gain  controller 

3  3 

VICTOR 

Variable-gain  simulation  of  baseline 

4  5 

Higher  overshoot  controllers 


Basel ine 

CADRE  baseline  controller 

4 

7 

VICTOR 

High-gain  variable-gain  controller 

— 

VICTOR 

Mid-gain  variable-gain  controller 

4 

5 

VICTOR 

Variable-gain  simulation  of  baseline 

4~5 

10 
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Fig.  1.  F-8C  DFBW  RAV  flight  test  technique. 


Fig.  2.  VICTOR  nonlinear  control  policy. 
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Fig.  3.  General  structure  of  RAE  nonlinear  pitch-rate  coitroller. 
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Fig.  4.  Baseline  plus  VICTOR-E  pitch-rate  controller. 


Fig.  5.  Operation  of  VICTOR-E  algorithm. 
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RAV  SUPPORT  SOFTWARE 
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Fig.  6.  Software  structure  for  CADRE  control  laws. 


Fig.  7.  Primary  har<Mare  elements  of  RAV  system. 
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Fig.  8.  F-8C  DFBW  floating  RAV  limiter. 
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9.  F-8C  DFBW  iron-bird  simulation  facility  configured  for  RAV  system  testing. 
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SUMMARY 

A  quad  redundant  digital  FBW  Control  System  for  a  highly  unstable  fighter  aircraft  has 
been  developed  and  flight  tested  by  MBB  in  a  single  seater  F-104  G  which  had  been  modi¬ 
fied  as  a  CCV  demonstrator.  The  CCV  program  was  funded  by  the  German  MOD. 

From  Dec.  1977  to  Nov.  1981  a  total  of  118  flights  has  been  conducted.  During  these 
flights  the  quadruplex  system  was  successfully  tested  for  five  different  configurations 
starting  with  the  highly  stable  basic  aircraft  and  ending  up  with  the  highly  unstable 
canard  configuration  with  a  static  instability  up  to  22%  mean  aerodynamic  chord  (MAC) . 

Some  of  the  results  obtained  regarding  control  system  design,  handling  evaluation  and 
redundancy  management  with  the  digital  system  will  be  presented. 


1 .  INTRODUCTION 

The  objectives  of  the  German  CCV-Demonstrator  Program  were  to  develop  and  flight  test 
a  quadruredundant  digital  fly-by-wire  control  system  and  to  investigate  the  stability 
and  control  characteristics  of  a  supersonic  aircraft  throughout  the  flight  envelope  with 
up  to  20%  negative  static  margin.  (Optimum  performance  improvement  of  future  aircraft 
resulting  from  relaxed  static  stability  will  be  reached  at  an  degree  of  instability  of 
10  -  20%  MAC.) 

First  a  brief  description  of  the  system  and  control  concept  will  be  given.  Thereafter 
some  problems  and  results  of  the  flight  tests  will  be  discussed. 


2.  PROGRAM  DESCRIPTION 

2.1  Destabilisation  and  Flight  Test  Sequence 

The  desired  degree  of  instability  of  the  demonstrator  aircraft  was  obtained  by  moun¬ 
ting  a  canard  surface  above  the  forward  fuselage  and  adding  660  kg  aft  ballast  (Fig.  1). 


Fig.  1  DESTABILISATION  CONCEPT 


By  the  fixed  canard  the  aerodynamic  center  is  moved  forward  by  approximately  35% 
whereas  by  the  tail  ballast  the  center  of  gravity  (c.g.)  is  moved  to  the  tip-up  aft 
1 imit . 

Destabilization  of  the  CCV  aircraft  was  done  in  several  steps.  This  is  shown  in 
Fig.  2. 


Fig.  2  FLIGHT  TEST  SEQUENCE 


The  B  1  configuration  is  the  basic  F-104  G  configuration  which  was  used  for  a  thorough 
flight  testing  of  the  newly  developed  digital  FBW  system.  In  B  2  600  kg  aft  ballast  were 
added  thus  reducing  static  stability  to  approximately  10%  MAC.  In  E  1  the  canard  was 
mounted.  As  forward  tank  fuel  is  not  used  here  and  212  kg  front  ballast  are  added  this 
configuration  is  still  stable  and  can  still  be  flown  manually  if  necessary.  It  was  there¬ 
fore  the  back  up  configuration  for  the  unstable  E  2  and  E  3  conf iguiatlon .  In  E  2  the 
canard  configuration  is  destabilized  by  400  kg  aft  ballast.  In  E  3  further  destabili¬ 
zation  is  reached  by  increasing  the  aft  ballast  to  660  kg  and  by  reversing  the  sequence 
of  fuel  usage.  Now  forward  tank  fuel  and  then  main  tank  fuel  is  used  before  tip  tank  fuel. 

2.2  Safety  system 

Due  to  limited  funding  no  iron-bird  ground  test  rig  could  be  built.  Therefore  the 
original  FCS  of  the  F-104  G  was  maintained  as  a  mechanical  back  up. 

By  pulling  the  stick  trigger  the  pilot  can  always  switch  from  the  FBW-system  to  the 
mechanical  system. 

2.3  Restabilization 

In  an  emergency  situation  the  unstable  demonstrator  aircraft  can  be  restabilized  by 
dropping  the  aft  ballast  (E  2  configuration) .  In  the  E  3  configuration  fuel  transfer  from 
the  tips  to  the  forward  tank  is  additionally  required.  Thereafter  the  aircraft  can  be 
flown  with  the  mechanical  back  up.  In  E  2  and  E  3  switch  over  to  MEC  is  coupled  with  the 
tail  ballast  dropping  mechanism. 

Ballast  jettisoning  was  successfully  demonstrated  in  FBW  Mode  in  the  B  2  configuration 
(400  kg  lead  shot) . 


3.  THE  CCV  FLIGHT  CONTROL  SYSTEM 


3.1  Main  features 

The  newly  developed  CCV-FCS  has  already  been  described  in  detail  in  Ref.  1.  Therefore 
only  the  main  features  of  the  system  are  repeated  here: 
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-  Double  fall-operational  redundancy 

-  Digital  data  processing  and  system  monitoring 

-  Application  of  multivariable  control  theory 

-  Integration  of  ADC,  CSAS,  Autopilot,  Navigation  and  BITE  functions  in  each  computer 

-  Central  inertial  sensors  with  strap  down  capability 

-  Shewed  flow  direction  sensors  (a, S) 

-  Modular,  selfmonitoring  secondary  actuators 

The  double  fail-operational  redundancy  is  provided  by  a  four  channel  system  (quadru- 
plex)  with  parallel  signal  processing  where  failures  are  detected,  localized  and  isola¬ 
ted  by  majority  vote.  A  system  overview  is  given  in  Fig.  3. 


Fig.  3  SYSTEM  OVERVIEW 

The  four  identical  computers  are  16  bit  computers  with  16  K  memory.  They  run  identi¬ 
cal  software  and  communicate  with  each  other  via  fast  data  lines  (direct  memory  access) . 
Each  computer  performs  the  following  functions: 

»  Stabilization  and  Control 
°  Autopilot 

o  Air  Data  Computation 
«  Inertial  Navigation  (Strap  down) 

<■  Preflight  Check  out 
»  Redundancy  Management 

The  necessary  signals  for  the  guidance  and  control  system  are  supplied  by  a  number  of 
sensors  which  can  be  seen  in  the  more  detailed  picture  of  Fig.  4. 


Fig.  4  CCV-F-104  G 

GUIDANCE  t  CONTROL  SYSTEM 
(One  Channel) 
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A  list  of  the  measured  variables  is  given  in  Fig.  5. 


a 

-  angle  of  attack 

ri 

vertical  velocity 

0 

-  angle  of  sideslip 

Vos?- 

ground  speed 

P 

-  roll  rate  "J 

X 

ground  track  angle 

q 

-  pitch  rate  >  body  fixed 

V 

flight  path  angle 

r 

-  yaw  rate  J 

dy  - 

cross  track  error 

0 

-  roll  angle 

0*  - 

geographic  latitude 

e 

-  pitch  angle 

/,  — 

geographic  longitude 

V 

-  heading 

P,  - 

static  pressure 

V 

-  total  velocity 

qc  - 

dynamic  pressure 

h 

-  altitude 

T,  - 

total  temperature 

Fig.  5  MEASURED  VARIABLES 


3-2  Control  System  Design 

The  FCS  of  the  CCV  aircraft  is  a  digital  FBW-System  with  100%  authority .  In  this 
system  the  pilot  no  longer  commands  control  surface  deflections  but  desired  values  of 
normal  acceleration ,  roll  rate  (around  the  velocity  vector)  and  sideslip  respectively 
With  the  pedals  untouched,  automatic  turn  coordination  is  provided.  Fig.  6  shows  a 
360°-roll  for  the  unstable  E  3  configuration. 


Fig.  6  360°  -  ROLL  (LEFT) 


It  can  be  seen  that  there  is  no  variation  of  load  factor  and  sideslip  with  bank  angle 
Sideslip  at  the  beginning  and  the  end  of  the  manoeuvre  is  less  than  0,5  degrees. 


One  of  the  unusual  features  of  the  control  system  is  attitude  feedback  in  the 
manual  control  mode  (switched  off  in  ground  operation) .  This  leads  to  a  reduction  of 
pilot  workload  by  making  the  aircraft  more  'stable*  and  was  commented  favourably  by  the 
pilots  who  judged  this  feature  as  an  excellent  means  for  general  aircraft  handling 
although  there  was  some  criticism  regarding  the  aircraft  flare  behavior.  This  is  dis¬ 
cussed  in  section  4. 


Linear  controllers  with  proportional  output  vector  feedback  are  used  for  the  longitu¬ 
dinal  and  lateral  motion.  Feedback  signals  are  angle  of  attack  a,  sideslip  8,  rates  p, 
q,  r  and  pitch  and  roll  attitude  0,  <J>. 

Compensation  of  coupling  effects  is  done  via  the  nonlinear  command  system  which  inter 
connects  all  three  axes  of  the  aircraft  (Ref.  2). 

Design  of  the  control  laws  was  based  on  linear  control  theory  for  multivariable  sy¬ 
stems  using  computer  aided  design  methods.  It  was  done  in  the  discrete  time  domain. 


Therefore  no  compensation  for  the  effects  of  sampling  was  required  which  otherwise  would 
have  been  necessary  due  to  the  low  sampling  rate  of  16  2/3  Hz. 

The  feedforward  and  feedback  coefficients  were  evaluated  for  each  configuration  for 
a  number  of  reference  points  in  a  Mach,  altitude  grid.  They  are  stored  in  the  computer 
memory.  Between  the  reference  points  the  coefficients  are  linearly  interpolated. 

The  maximum  allowed  desired  values  Anzd»  wxd  an<*  Pd  are  a^so  functions  of  Mach  and 
altitude . 

Structural  coupling  ground  tests  with  the  closed  loop  system  showed  the  necessity  for 
filtering  of  pitch  and  roll  rate.  (The  rate  gyros  of  the  IMU-System  are  mounted  in  the 
nose  cone.)  Therefore  structural  filters  had  to  be  introduced. 

For  the  yaw  axis  ground  test  had  shown  sufficient  structural  damping  but  during  the 
first  closed  loop  flights  a  yaw  oscillation  of  6,8  Hz  occurred  and  lead  to  the  aposteriory 
installation  of  a  yaw  rate  notch  filter.  Due  to  the  flexibility  of  the  digital  system 
this  was  no  problem  at  all  and  could  be  done  within  a  few  days.  All  filtering  was  done 
digitally,  with  a  sampling  rate  of  50  Hz  for  the  structural  filters. 


4.  FLIGHT  TEST  EXPERIENCE 

4.1  Testing  of  the  Different  Configurations 

Before  the  first  closed  loop  flight  with  the  new  control  system,  direct  link  flights 
(1:1)  in  FBW  were  conducted  with  50  Hz  sampling  first  and  then  with  16  2/3  Hz  to  see 
whether  the  low  sampling  rate  would  degrade  aircraft  handling.  This  was  not  the  case. 

For  the  B  1  and  B  2  configuration  the  MIL-Spec  requirements  for  frequency  and  damping 
of  the  short  period  and  dutch  roll  mode  were  fulfilled  from  the  beginning.  Therefore,  no 
change  of  the  theoretical  feedback  coefficients  was  required.  However,  some  modif ications 
became  necessary  for  pitch  and  roll  control  during  landing.  In  roll  pilots  complained 
about  the  late  roll  onset  and  to  high  a  minimum  achievable  roll  rate.  The  problem  could 
be  solved  by  the  following  measures: 

-  Change  of  the  roll  stick  shaping  filter  from  second  order  to  first  order. 

-  Minimisation  of  the  dead  zone  (software)  around  the  roll  sticks  neutral  position. 

These  measures  reduced  the  phase  lag. 

-  Reduction  of  maximum  desired  roll  rate  wx,  below  Ma  =  0,4  (fading  between  Ma  -  0,4  and 

Ma  =  0,3) .  a 

-  Adaptation  of  the  direct  link  gain  (aileron  angle  due  to  commanded  roll  rate) 

In  a  second  step  the  time  constant  of  the  stick  shaping  filter  was  reduced  to  50%. 
Thereafter  pilot  ratings  were  good  for  all  weather  conditions. 

In  pitch  an  overcontrol  tendency  was  observed  during  the  landing  flare  phase  which 
was  unpredii  fed  by  PlO-evaluations .  It  was  not  considered  safety  critical  but  pilots 
wanted  improvement.  After  removing  the  stick  command  pitch  filter  pilot  ratings  (Cooper- 
Harper)  of  3-4  were  given. 

In  some  flights  (B  2  and  E  1  configuration)  the  attitude  feedback  was  switched  off 
by  the  pilot  before  landing.  Here  Cooper-Harper  ratings  of  2  were  given.  This  indicates 
that  not  any  phase  lag  in  the  low  sampled  digital  system  was  responsible  for  the  deficien¬ 
cies,  but  the  different  control  strategy  during  round  out  in  attitude  'on'  mode.  In  the 
attitude  feedback  system  definite  forward  stick  pushing  is  required  if  the  pilot  wants  to 
lower  the  nose  of  the  aircraft  whereas  with  attitude  ’off'  he  just  has  to  release  the 
stick.  This  is  the  conventional  procedure  he  is  used  to. 

The  first  flight  in  the  canard  configuration  E  1  (practically  a  new  aircraft)  was 
v.x.hout  any  problems.  Handling  characteristics  were  very  favourably  commented  on  by  the 
pilot . 

The  whole  first  flight  was  made  in  FBW-Mode  because  simulator  studies  had  shown 
better  handling  in  TEW  than  in  the  mechanical  back  up  mode.  Especially  take  off  in  MEC 
might  have  been  critical  due  to  a  strong  pitch  up  tendency. 

In  later  flights  bad  damping  at  high  Mach  numbers  was  observed.  This  was  due  to  an 
incorrect  description  of  the  aerodynamics  of  the  canard  aircraft  at  higher  Mach  numbers. 
Parameter  identification  and  subsequent  modification  of  the  controller  coefficients 
solved  the  problem. 

When  enough  experience  had  been  gathered  with  the  stable  canard  aircraft  E  1  flight 
testing  of  the  unstable  canard  configurations  E  2  and  E  3  was  taken  up.  After  the  prior 
thorough  flight  testing  these  tests  could  be  completed  rather  fast.  From  July  to  Novem¬ 
ber  1981,  22  flights  were  conducted,  14  flights  in  the  moderately  unstable  E  2-  and  8  in 
the  highly  unstable  £  3  configuration.  The  highest  instability  reached  in  normal  flight 
was  up  to  22%  MAC  at  about  11"  a. 
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The  aircraft  was  always  easily  controllable  with  the  CCV-FCS  even  when  during  landing 
-  not  quite  planned  -  an  instability  of  t6%  was  reached  due  to  an  malf unctioning  of  tip 
fuel  feeding. 

Fig.  8  shows  a  wind  up  turn  in  the  unstable  E  3  configuration.  With  increasing  angle 
of  attack  the  instability  becomes  obvious  by  the  stabilizer  moving  in  a  positive  direction 
(contrary  to  the  stick) .  For  comparison  in  Fig.  9  the  same  manoeuvre  is  shown  for  the 
stable  E  1  configuration.  Here  stick  and  stabilizer  move  in  the  same  direction.  The  pilot 
reported  good  control  and  very  nice  constant  stick  force  gradients. 


Fig  8  WUT: UNSTABLE  E  3  CONFIGURATION  Fig.  9  WUT: STABLE  E  1  CONFIGURATION 

4.2  The  ’Backswing'  Problem 

One  problem  which  was  mainly  observed  in  the  canard  configuration  was  a  two-step-rate 
response  with  'backswing'  after  a  pitch  stick  command  (Fig.  10).  Although  for  manoeuver- 
ing,  limited  tracking  and  wind  up  turn,  aircraft  control  seemed  very  good,  this  control 
behaviour  caused  problems  for  small  attitude  changes,  speed  changes  and  precise  small 
pitch  corrections. 

By  introducing  stick  shaping  filters  aircraft  behaviour  could  be  significantly  im¬ 
proved.  In  Fig.  It  pitch  step  response  after  introduction  of  the  filter  is  shown  (same 
flight  condition,  same  configuration). 
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Fig.  10  BACKSWING 


Fig.  11  NO  BACKSWING 


After  termination  of  the  unstable  aircraft  testing  some  additional  flights  in  the 
E  1  configuration  were  made  in  1982  where  the  coefficients  of  the  shaping  filters  were 
changed  depending  on  Mach  numbers  and  altitude  thus  further  optimising  pitch  response  - 
as  the  pilot  wrote  in  his  flight  report  *to  an  almost  excellent  level  exceeding  aircraft 
handling  in  stable  configurations  with  mechanical  control  systems'. 

Such  sophisticated  mechanizations  are  no  problem  in  digital  systems.  The  required 
program  change  (assembler)  and  testing  was  done  within  less  than  a  fortnight. 

In  the  shaping  filters  a  direct  throughput  was  maintained  to  avoid  increased  time 
delay. 


4.3  Trimming  in  Pitch  and  Roll 

One  last  problem  which  shall  be  addressed  is  pitch  and  roll  trim. 

When  the  FCS  was  first  designed  it  was  thought  unnecessary  to  have  a  special  trim 
possibility  because  in  a  rate  command  system  the  stick  is  in  the  neutral  position  for 
steady  flight.  But  after  the  first  simulations  pilots  insisted  on  the  introduction  of  a 
trim  possibility  -  first  in  pitch,  than  in  roll  too  -. 

In  the  FBW  mode  no  trim  motor  is  used  because  it  would  be  counteracted  by  the  con¬ 
troller  (unlimited  authority) .  Trim  inputs  are  given  via  the  non-linear  command  system, 
that  is,  they  are  identical  to  small  stick  inputs. 

In  roll  a  fixed  value  wX(j  __  is  commanded  by  the  trim  button.  It  becomes  zero  again 
when  the  button  is  released. 

Small  precise  roll  angle  corrections  can  be  made  with  this  system. 


Different  to  roll  in  the  first  mechanization  the  pitch  trim  button  commanded  an  in¬ 
creasing  AnzdTR  which  was  held  constant  at  release.  This  was  for  enabling  trimmed  turns 
(for  60°  bank  a  An2^  of  1  is  required  equivalent  to  a  load  factor  of  2) .  However,  with 
this  system  it  was  very  hard  to  find  the  trim  neutral  point  and  quick  stabilization  was 
not  possible.  The  problem  was  pronounced  by  the  ' backswing'  behaviour. 

Therefore,  now  a  mechanization  similar  to  that  in  roll  has  been  installed  with  the 
trim  signal  filtered. 


5.  THE  SAFETY  PROBLEM 

As  already  mentioned  the  CCV-FCS  is  a  quadruplex  system  with  fail-op,  fail-op  capa¬ 
bility.  The  decision  to  go  quadruplex  proved  right  because  during  all  118  (125)  flights 
no  critical  failure  of  the  FCS  occurred  -  in  spite  of  a  lot  of  computer  hardware  trouble 
(bad  multilayer  connections  -  design  problem  -  and  ray  clad  solder  sleeve  failures)  and 
-  at  the  beginning  -  actuator  trouble. 

Without  a  reliable  system  flight  testing  of  the  unstable  configurations  would  have 
been  impossible  because  malfunctioning  might  have  been  catastrophic. 

The  main  work  with  regard  to  the  redundancy  management  had  already  been  done  during 
the  development  phase  before  flight  test.  But  some  modification  and  optimization  had  to 
be  done  during  the  flight  phase  -  this  was  partly  due  to  the  lack  of  an  iron  bird  ground 
test  rig. 

5.1  Signalconsolidation 

To  avoid  drift  of  the  computer  outputs  in  the  different  lanes  and  therefore  failures, 
the  input  signals  had  to  be  consolidated.  This  is  done  in  the  following  way: 

Each  computer  sends  one  set  of  signals  it  has  received  from  its  A/D-inferf ace  to  the 
three  other  computers.  So  each  computer  has  four  sets  of  data  available  in  its  memory. 
Each  computer  now  generates  the  average  of  the  different  signals. 

In  order  not  to  spoil  the  average  value  only  those  signals  are  taken  which  have  been 
found  error  free.  That  means  that  prior  to  consolidation  the  input  signals  have  to  pass 
a  failure  detection  procedure. 

As  not  only  the  signals  can  fail  but  the  data  transmission  between  the  computers  as 
well,  transmission  failures  are  detected  via  check  sum  generation  and  comparison. 

Where  possible  the  same  software  routines  have  been  used  for  failure  detection  and 
signal  consolidation  to  keep  the  program  small.  Because  during  tests  some  failures 
occurred  which  were  due  to  the  fact  that  the  computers  in  spite  of  their  internal  clock 
were  slowly  drifting  apart,  exact  synchronization  became  necessary.  This  was  reached  by 
hardware  interconnect  which  forced  all  computer  clocks  to  the  same  frequency. 

5.2  Failure  Display 

In  the  failure  routine  each  computer  compares  its  own  input  signals  with  those  of  the 
other  three  channels.  As  there  are  always  small  discrepancies  between  the  signals  due  to 
sensor-  and  interface  tolerances  failure  limits  had  to  be  defined.  Each  trespassing  of 
the  limits  leads  to  the  immediate  exclusion  of  the  failed  signal  in  the  averaging  process 
but  not  to  immediate  failure  display.  Only  if  the  limits  are  exceeded  for  more  than  a 
prescribed  period  of  time  (number  of  cycles)  a  failure  indication  on  the  Control  and  Dis¬ 
play  Unit  (CDU)  is  given  (Fig.  12).  Thus  unnecessary  irritation  of  the  pilot  in  case  of 
short  trespassings  is  avoided.  Final  definition  of  the  failure  limits  and  counter  cycles 
was  a  development  process  during  flight  testing.  The  number  of  cycles  (and  of  course  the 
limits)  are  different  for  different  signals. 

The  computer  output  signals  for  example  which  go  to  the  actuators  must  exceed  the 
limits  for  at  least  4  cycles  (cycle  time  is  60  ms)  before  a  failure  is  indicated. 
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5.3  Software  Validation 

In  a  digital  system  there  always  arises  the  problem  of  generic  software  errors  which 
cannot  be  overcome  by  redundancy  because  each  channel  contains  the  same  error.  Therefore, 
effective  software  test  methods  are  of  great  importance.  In  case  of  the  CCV-FCS  software 
testing  is  done  in  several  steps. 

Each  program  for  the  flight  computers  was  written  in  assembler  using  a  cross  assemb¬ 
ler  that  has  been  specially  developed  for  a  PDP  11/70,  The  program  has  a  block  structure. 
For  each  block  a  check  sum  is  evaluated.  If  there  is  any  program  change  the  dedicated 
check  sums  are  changed  too.  Thus  it  is  easy  to  find  on  a  compare  list  which  parts  have 
to  be  tested  after  program  changes. 

Each  new  program  is  loaded  into  a  flight  computer  via  punched  paper  tape  and  then 
checked  in  the  laboratory  with  different  input  signals.  Output  of  internal  values  is  on 
the  Control  and  Display  Unit  (digitally)  or  via  the  flight  computer  telemetry  program 
on  a  plotter  -  a  telemetry  set  is  available  in  the  lab. 

Thereafter  closed  loop  simulations  follow  with  the  flight  computer  in  the  loop  where 
pilots  ’fly'  the  digitally  simulated  aircraft  from  a  cockpit. 

For  test  purposes  a  second  non-linear  simulation  program  has  been  written  on  a 
VAX  11/780.  There  is  no  interface  for  analog  inputs  or  outputs. 

This  program  (aircrafts  equation  of  motion  and  controller)  is  written  in  Fortran 
whereas  in  first  simulation  SL1  is  used  for  the  aircraft  and  assembler  for  the  controller 
(flight  computer  program) .  As  both  simulations  are  based  on  the  same  set  of  aerodynamic 
data  simulation  results  can  be  compared  to  check  for  programming  errors. 

Redundancy  procedures,  safety  routines  and  limitations  can  only  be  checked  with  all 
four  systems  in  the  aircraft.  Therefore  after  each  change  in  the  flight  computer  pro¬ 
gram  a  special  ground  test  was  conducted  with  the  aircraft. 

Additionally,  before  each  flight  the  pre-flight  test  program  was  run. 


During  flight  tests  some  software  problems  were  detected  which  had  not  been  found 
in  ground  tests.  Most  of  them  were  due  to  'wrong  thinking'  that  is  to  introducing  logic 
functions,  software  limitations  or  quick  program  changes  which  had  not  been  considered 
in  all  consequences. 

In  this  context  the  otherwise  so  valuable  flexibility  of  the  digital  system  was  kind 
of  dangerous  because  changes  from  one  flight  to  the  next  -  just  to  try  something  new  - 
could  be  made  so  easily. 

One  failure  which  might  be  of  interest  here  was  due  to  a  scaling  error  (in  the 
quaternion  program  part)  which  was  very  difficult  to  detect.  We  might  have  flown  with  it 
for  years  if  not  by  chance  the  pilot  would  have  flown  exactly  18G°  headinq  with  exactly 
zero  bank  and  zero  pitch  attitude.  Only  when  these  conditions  were  fulfilled  overflow 
occurred.  This  overflow  led  to  a  moderate  step  input  in  roll. 


6.  CONCLUSIONS 

A  newly  developed  quadruredundant  digital  flight  control  system  .  is  been  installed 
in  a  CCV  demonstrator  aircraft  and  flight  tested  up  to  22%  negat  i  ve  stat  ic  margin. 

The  aircraft  was  always  easily  controllable  even  in  the  highly  unstable  configuration 
All  three  pilots  who  have  flown  the  system  confirmed  generally  good  handling  qualities. 
Areas  of  criticism  and  improvements  have  been  discussed. 

The  flights  have  demonstrated  that  the  redundancy  management  problems  have  been 
successfully  solved  and  that  an  unstable  aircraft  can  be  flown  safely. 

They  have  also  demonstrated  that  digital  systems  are  superior  to  analog  systems  as 
they  allow  the  installation  of  complex  systems  with  subsequent  chanqes  and  optimization 
by  pure  software  change  in  very  short  time. 

The  CCV  program  will  be  continued.  Future  work  amongst  other  will  be  on  simple  back 
up  software,  which  can  be  easily  checked  for  programming  errors  (first  flights  in  Sep¬ 
tember  this  year)  and  on  dissimilar  software. 
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SUMMARY 


A  national  (U.K.)  research  programme  has  been  undertaken  with  the  aim  of  the  design, 
development  and  demonstration  of  a  safe,  practical  full  time  fly-by-wire  flight  control 
system  for  a  combat  aircraft.  Throughout  the  programme,  the  flight  control  system  was  to 
be  treated  in  all  airworthiness  aspects  as  though  it  were  intended  for  production.  The 
flight  trials  were  to  include  flight  assessment  of  an  integral  spin  prevention  system  and 
aircraft  configurations  which  are  unstable  in  pitch.  The  first  major  objective  of  the 
programme  has  been  achieved,  namely  the  generation  of  confidence  in  the  airworthiness  of 
such  a  system,  by  the  successful  completion  of  the  design,  development,  ground  testing 
and  initial  flight  test  assessment  of  a  fully  representative  system. 

1.0  INTRODUCTION 


The  first  flight  of  the  British  Aerospace  Fly-By-Wire  Jaguar  in  October  1981 
represented  the  culmination  of  a  national  (U.K.)  research  programme.  The  FBW  demonstrator 
programme  formally  began  in  1977  with  the  award  of  a  contract  to  British  Aerospace  by  the 
Ministry  of  Defence.  Prior  to  1977*  British  Aerospace  (then  the  British  Aircraft 
Corporation)  had  begun  studies  into  Active  Control  Technology  (ACT)  with  a  view  to 
utilising  the  benefits  of  such  technology  in  future  combat  aircraft.  Also  in  the  early 
70* s  Marconi  Avionics  were  continuing  the  development  of  digital  processors  in  a  number 
of  aircraft  applications  including  the  Tornado  and  the  YC14;  and  Dowty  Boulton  Paul  were 
developing  a  novel  actuator  design  based  on  the  principle  of  failure  absorption.  When 
the  research  contract  was  awarded  to  British  Aerospace,  Marconi  Avionics  were  selected  to 
supply  the  Flight  Control  System  which  was  to  comprise  a  quadruplex  digital  system  and 
Dowty  Boulton  Paul  were  selected  to  supply  the  powered  flying  controls  which  would  comprise 
a  duo-triplex  actuation  system.  The  technical  sponsors  of  the  research  programme  were  to 
be  the  Flight  Systems  Division  of  the  Royal  Aircraft  Establishment  (RAE)  at  Farnborough • 


Hie  aim  of  the  research  programme  was  defined  as  the  design,  development  and 
demonstration  of  a  safe,  practical ,  full  time,  fly-by-wire  flight  control  system  for  a 
combat  aircraft.  Throughout  the  programme,  the  flight  control  system  was  to  be  treated 
in  all  airworthiness  aspects  as  though  it  were  intended  for  production.  Although  it  was 
not  intended  to  demonstrate  the  aerodynamic  benefits  of  ACT,  the  programme  included 
flight  demonstration  of  the  aircraft  in  an  unstable  conf igurat ion  in  pitch  and  of  a  Stall 
Departure  Spin  Prevention  System.  Since  the  integrity  standard  of  the  flight  control 
system  was  designed  to  be  comparable  with  existing  mechanical  systems,  and  in  addition, 
the  aircraft  was  to  be  flown  in  an  unstable  configuration,  it  was  decided  early  in  the 
definition  phase  to  remove  all  the  mechanical  control  rods.  Thus  the  FBW  Jaguar 
quadruplex  digital  flight  control  system  has  no  emergency  back  up  flight  control  system 
of  any  kind. 

This  paper  describes  the  extensive  rig  and  ground  testing  performed  which  resulted 
in  the  first  major  objective  being  achieved,  a  clearance  for  the  first  flight  of  the 
aircraft.  It  then  describes  the  first  phases  of  the  flight  test  assessment  which  were 
completed  ahead  of  schedule  and  a  series  of  simulated  whole  aircraft  lightning  tests 
which  were  carried  out  prior  to  the  next  phase  of  the  flight  assessment. 

2.0  AIRCRAFT  AND  SYSTEMS  DESCRIPTION 


2. 1  Aircraft 


The  FBW  Jaguar  demonstrator  aircraft  is  a  modified  single  seat  Sepecat  Jaguar.  The 
aircraft  started  life  as  the  sixty-second  production  Jaguar  and  it  served  with  the  Royal 
Air  Force  for  several  years  before  being  returned  to  Warton  to  be  extensively  modified  to 
become  the  FBW  demonstrator  aircraft*  In  general,  only  minor  changes  to  the  structure 
have  been  made  to  accommodate  the  new  equipment.  Some  internal  equipment,  principally 
the  guns  and  ammunition  trays  were  removed  to  make  way  for  the  flight  control  system 
computers  and  the  very  extensive  instrumentation  system  fitted  to  the  aircraft.  All  the 
mechanical  control  rods,  the  autostabiliser  equipment  and  the  original  powered  flight 
control  units  were  also  removed.  Thus  the  external  appearance  of  the  aircraft  is  little 
changed.  However,  for  the  high  incidence  trials,  an  anti-spin  parachute  will  be  fitted 
in  place  of  the  standard  brake  parachute;  and  later  in  the  flight  trials  programme, 
leading  edge  strakes  will  be  fitted  along  the  air  intake  boxes. 

Hie  aircraft  has  provision  for  a  large  block  of  fixed  internal  ballast  to  be  carried 
in  the  rear  fuselage.  This  ballast  and  some  alterations  to  the  fuel  management  procedures 
will  enable  the  centre  of  gravity  to  be  moved  aft  to  give  a  manoeuvre  point  of  -3/»c  to 

The  addition  of  the  leading  edge  strakes  will  move  the  centre  of  pressure  forward  to 
give  a  manoeuvre  point  of  -10%8. 

2.2  Flight  Control  System 

The  flight  control  system  (FCS)  is  basically  a  quadruplex  digital  system  with  no 
manual  reversion.  All  mechanical  control  rods  downstream  of  the  trim  and  feel  units  have 
been  removed.  Quadruplex  position  sensors  (QPS)  are  used  to  sense  pilot  control  demands 
in  terms  of  stick,  pedal  and  trim  inputs  and  quadruplex  rate  gyros  sense  aircraft  pitch, 
roll  and  yaw  rates*  Four  identical  digital  flight  control  computers  (FCC)  are  used  to 
process  these  signals  together  with  a  variety  of  other  sensors*  The  resulting  command 
signals  are  used  to  control  the  two  taileron,  two  spoiler  and  one  rudder  actuators.  In 
order  to  convert  the  quadruplex  signals  from  the  FCCs  into  the  sextuplex  signals 
required  by  the  duo-triplex  actuators,  the  four  FCCs  are  supplemented  by  two  actuator 
drive  and  monitor  computers  ( ADMC ) .  This  system  layout  was  a  result  of  the  following 
considerations. 

Overall  system  loss  probability  (including  first  stage  actuation)  shall  be  no 
greater  than  10-7  per  hour. 

-  Any  two  electrical  failures  in  the  system  shall  be  able  to  be  survived. 

-  The  electrohydraulic  first  stage  actuation  would  have  only  two  independent 
hydraulic  supplies  with  no  interconnection  between  them. 

The  system  shall  be  able  to  survive  a  hydraulic  system  failure  followed  by  an 
electrical  system  failure  or  an  electrical  followed  by  a  hydraulic  failure. 

The  system  shall  rely  on  majority  voting  of  the  redundant  elements  for  failure 
survival  rather  than  self-monitoring  within  each  redundant  element. 

-  Similar  redundant  digital  implementation  shall  be  adopted  without  any  reliance  on 
any  back  up  flight  controls  (eg:  mechanical  or  sample  analogue  links)* 

The  Jaguar  FBW  system  configuration  is  illustrated  in  Fig'ire  1  which  presents  a 
simplified  schematic  of  the  primary  control  path*  In  addition  to  the  quadruplex  primary 
input  sensors,  sensors  of  lower  redundancy  are  used  for  those  functions  which  may  be 
necessary  for  optimum  handling  qualities  but  which  are  not  necessary  for  safe  flight* 

These  are  dynamic  pressure,  static  pressure,  incidence  and  sideslip  which  are  all  triplex 
secondary  sensors;  and  lateral  acceleration,  flap  position  and  airbrake  position  which  are 
duplex  sensors*  Triplex  dynamic  and  static  pressures  are  provided  by  three  pitot  static 
probes  (the  standard  nose  boom  and  two  side  mounted  probes)*  Triplex  incidence  and  sideslip 


signals  are  provided  by  four  airstream  direction  detector  probes  (ADD)  mounted  around  the 
nose  of  the  aircraft. 


The  FCS  also  uses  a  number  of  quadruplex  and  duplex  discrete  inputs  for  switching 
functions.  A  simplified  overall  system  conf iguration  is  illus crated  in  Figure  2.  A  more 
detailed  description  of  the  system  architecture  and  the  system  LRUs  can  be  found  in 
reference  1. 

Powered  Flying  Control  Units 

The  taileron,  rudder  and  spoiler  PFCUs  each  consist  of  a  duo-triplex  first  stage 
actuator  block  and  a  duplex  tandem  jack.  All  five  are  similar  in  design,  differences 
between  them  being  limited  to  valve  port  sizes,  jack  strokes  and  diameters,  connector 
handing  etc. 

The  PFCUs  contain  six  flapper  nozzle  servo  valves  which  convert  electrical  inputs 
from  the  FCCs  and  ADMCs  into  hydraulic  signals  which  are  then  used  to  drive  a  pair  of 
first  stage  spool/control  valves.  Each  servo  valve  is  connected  to  two  pairs  of  opposing 
pistons  inside  one  of  these  first  stage  actuators.  Hie  pistons  act  on  flanges  mounted  on 
the  actuator  spools,  two  pairs  being  used  to  prevent  asymmetric  loading.  Both  flanges 
are  therefore  driven  by  six  pairs  of  opposing  pistons,  two  pairs  from  each  of  three  servo 
valves.  A  mechanical  link  between  the  two  actuators  ensures  that  the  spools  and  thus  the 
flanges  move  in  unison,  so  that  all  six  servo  valve  outputs  are  effectively  summed 
together.  In  this  way  failures  in  at  least  two  lanes  can  be  absorbed  within  the  actuators, 
the  four  good  lanes  overriding  the  failed  lanes.  Movement  of  the  first  stage  actuators 
results  in  hydraulic  fluid  being  supplied  to  the  control  surface  jack.  The  jacks  are 
conventional  tandem  units.  Hydraulic  supplies  from  the  two  aircraft  systems  are  routed 
through  the  first  stage  actuators,  each  system  also  supplying  the  actuator's  associated 
trio  of  servo  valves.  Failure  of  one  of  these  hydraulic  supplies  can  be  tolerated  by  the 
PFCUs  in  addition  to  at  least  one  electrical  failure  in  the  lanes  supplying  the  unaffected 
side  of  the  actuator. 

2.3  General  Aircraft  Systems 

Electrical  Power  Sv.pplies 

DC  electrical  power  is  normally  supplied  by  two  engine  driven  alternators  via  two 
transformer  rectifier  units  (TRUs).  A  third  TRU,  not  present  on  standard  Jaguar,  was 
added  to  cover  the  additional  loading  of  the  fly-by-wire  system  and  ancillaries.  To  meet 
the  power  supply  integrity  requirements  of  the  FCS  (including  supply  following  double 
engine  flameout)  revised  power  distribution  and  emergency  systems  were  introduced. 

The  three  TRUs  supply  three  busbars,the  two  normal  busbars  and  a  dedicated  FC  busbar. 
The  flight  control  system  is  then  supplied  from  the  three  busbars.  For  emergency  operation, 
each  of  the  normal  busbars  supplying  the  FCS  is  battery  backed.  Each  is  supplied  by  a  40 
amp-hour  battery,  and  provides  power  for  the  two  electrohydraulic  pumps  in  addition  to  the 
FCS.  Hie  dedicated  FC  busbar  is  supplied  by  a  23  amp-hour  battery. 

Hydraulic  Power  Supplies 

Engine  driven  pumps  are  the  primary  source  of  power  in  the  Jaguar's  two  independent 
hydraulic  systems.  They  are  supplemented  by  a  power  transfer  unit  (PTU)  which  allows  the 
transfer  of  power  but  not  fluid  between  systems,  and  an  emergency  electrohydraulic  pump 
(EHP)  on  the  number  two  system.  Higher  power  and  integrity  requirements  of  the  fly-by-wire 
aircraft  have  necessitated  replacement  of  the  engine  driven  pumps  and  the  electrohydraulic 
pump  by  units  with  greater  capacity,  and  the  provision  of  a  new,  second  EHP.  This  new 
EHP  provides  pressure  to  the  number  one  system  in  an  emergency.  Both  EHPs  provide  power 
primarily  to  the  flying  control  actuators,  services  being  supplied  via  a  priority  valve 
(which  maintains  pressure  to  the  controls)  and  an  isolation  valve  (which  is  closed  by  a 
low  level  signal  to  protect  against  hydraulic  leaks  in  the  services).  At  present,  it  has 
not  been  found  necessary  to  fit  the  priority  valves  but  they  are  available  if  future 
testing  indicates  a  requirement. 

Air  Conditioning 

Hie  normal  Jaguar  air  conditioning  system  was  retained  but  with  additional  ducts  and 
ground  fans  to  allow  cooling  air  to  be  supplied  to  the  FCS  computers. 

Flight  Teat  Instrumentation 

An  extensive  on  board  data  acquisition  system  was  fitted  to  the  aircraft  during  the 
conversion  phase. 

This  comprises  pulse  code  modulation  (PCM)  and  analogue  systems  which  record  data  on 
an  on-board  14  track  tape  recorder  and  a  limited  telemetry  system  (described  in  more 
detail  in  Section  8)  which  includes  a  'hot  mike'  facility.  In  addition,  flutter  mode 
excitation  equipment  in  the  form  of  groups  of  lateral  thrust  units  (LTV)  or  'bonker  packs' 
were  fitted  to  the  fin  and  tailplane  together  with  a  pilot  operated  LTV  fire  control 
panel.  Also  fitted  to  the  aircraft  are  special  cockpit  displays  for  high  incidence  test 
flying  and  these  include  wide  range  incidence  and  sideslip  indicators  and  visual  and  audio 
warnings  for  lo\  altitude  and  high  levels  of  longitudinal  acceleration.  The 
instrumentation  system  only  interfaces  with  FCC 4  for  integrity  reasons  but  a  considerable 


amount  of  FCS  data  is  recorded.  The  inter  FCC  serial  digital  link  has  an  instrumentation 
'window1  which  is  programmable  and  allows  access  to  any  data  in  the  FCC  store. 

2.4  FCS  Control  Laws 


The  design  aim  of  the  control  laws  is  to  give  the  FBW  Jaguar  handling  qualities  at 
least  as  good  as  the  standard  Jaguar  over  the  full  flight  envelope  and  in  a  wide  variety 
of  configurations.  The  FCS  also  has  to  provide  an  integral  stall  departure  arid  spin 
prevention  system  (SDSP)  as  well  as  to  respect  those  load  limits  which  are  not  restricted 
by  flight  limitations  -  for  example  fin  loads. 

Two  sets  of  control  laws  are  used;  one  for  the  stable  and  one  for  the  imstable  pitch 
conf igurations.  Both  sets  of  laws  can  be  stored  in  the  FCC,  but  for  safety  reasons  are 
loaded  separately  into  the  computers.  Provision  for  a  further  two  modes  has  been  made 
which  may  be  selected  using  the  gain  change  switch  on  the  pilots  control  panel.  It  is 
planned  to  use  this  option  during  the  highly  unstable  flying  to  enable  assessment  of 
development  modes  of  the  imstable  control  laws • 

Longitudinal  Laws 

The  longitudinal  control  laws  are  based  on  a  pitch  rate  plus  incidence  demand  system. 
The  pilot's  control  input  is  converted  to  a  pitch  rate  demand  and  the  incidence  into 
equivalent  pitch  rate  before  being  compared  with  pitch  rate  feedback.  The  pitch  rate 
error  signal  is  converted  to  a  tailplane  demand  signal  via  a  proportional,  integral  and 
differential  (PID)  controller.  This  type  of  controller  minimises  the  spread  in  stick 
force  per  g  variation  with  aircraft  conf igurat ion  and  manoeuvre  margin  and  ensures  good 
handling  qualities.  Pitch  axis  gains  are  scheduled  with  airspeed,  altitude,  incidence 
and  undercarriage  position.  A  non-linear  "manoeuvre  boost"  path  is  also  included  as  an 
additional  forward  path  in  the  pitch  loop.  This  gives  a  marked  improvement  in  shortterm 
response  to  stick  inputs  by  combining  good  tracking  ability  with  rapid  response  in  large  . 
perturbation  manoeuvres.  The  incidence  limiting  function  of  the  SDSP  is  an  integral  part 
of  the  longitudinal  control  laws. 

Lateral  Laws 


The  lateral  control  loop  is  a  roll  rate  command  system  wherein  roll  rate  demand  from 
the  lateral  stick  is  compared  with  actual  roll  rate  to  produce  a  roll  rate  error  signal 
which  commands  spoiler  and  differential  tailplane  deflection.  A  feed  forward  path 
provides  a  good  roll  acceleration  and  the  control  demand  necessary  to  maintain  the  desired 
roll  rate  in  a  steady  roll.  At  low  incidence  roll  control  is  basically  provided  by  the 
spoilers.  Differential  tailplane  is  used  to  augment  the  spoilers  as  a  function  of  airspeed 
and  incidence  and  rudder  is  used  as  a  function  of  incidence.  These  interconnects  provide 
good  co-ordination  and  roll  performance  and  the  SDSP  functions  are  inherent  in  the  control 
law  scheduling. 

Directional  Laws 


Tlie  directional  control  laws  consist  of  a  wind  axis  yaw  damper  with  sideslip  feedback 
to  augment  directional  stiffness.  The  wind  axis  yaw  rate  is  synthesised  from  body  axis 
yaw  and  roll  rates.  Turn  entry  and  exit  at  low  speed  is  improved  using  a  synthesised 
bank  angle  term  from  a  further  roll  rate  to  rudder  crossfeed. 

Sideslip  feedback  is  used  to  augment  directional  stability  at  high  incidence 
although  it  is  also  available  for  augmentation  at  low  incidence  for  low  directional 
stability  store  configurations. 

As  in  the  roll  axis,  the  SDSP  function  is  inherent  in  the  gain  scheduling,  for 
example  rudder  pedal  authority  with  undercarriage  up  is  progressi vely  reduced  as  incidence 
is  increased  in  order  to  prevent  pilot  induced  departures. 

Fixed  Gains  and  Train  Mode 

In  the  event  of  a  double  failure  in  the  triplex  secondary  sensors  (ie:  incidence, 
sideslip,  airspeed  or  altitule)  the  control  laws  are  switched  to  a  fixed  gain  mode.  In 
this  condition  all  schedul i  1  mictions  are  set  to  fixed  values  and  undercarriage 
position  is  used  to  select  : \  ?  appropriate  gains.  In  order  to  allow  pilot  assessment  of 
this  condition,  a  Training  mod*  is  provided  in  the  control  laws  which  is  equivalent  to 
the  fixed  gains  mode  and  the  pilot  can  select  and  d*  selc^ct  this  mode  via  a  cockpit  switch. 

Spin  Recovery  Mode 


TTie  spin  recovery  mode  is  only  intended  for  recovery  from  developed  spins  where  the 
rate  feedback  terms  in  the  normal  control  modes  would  apply  adverse  control  inputs  and 
hinder  recovery,  TTie  spin  recovery  mode  provides  a  direct  position  control  of  moan  and 
differential  tailplane,  rodder  and  spoilers  with  no  other  motion  feedback.  The  mode  is 
really  only  a  test  facility  foi  emergency  use  when  proving  the  SDSP  system  and  strictly 
is  not  therefore  an  integral  part  of  the  control  laws. 


3.0  FCS  BUILT  IX  TEST  FACILITIES 


The  Built-In- Teat  (BIT)  requirement  and  facilities  were  broadly  defined  by  BAe  in 
their  Jaguar  FBW  Integrated  Flight  Control  System  (IFCS)  base  specification.  This  may 
be  summarised  by  noting  that  the  BIT  features  were  to  provide  an  accurate  decisive  and 
repeatable  method  of  measuring  equipment  functional  characteristics  using  built-in-test 
facilities. 

In  particular,  the  BIT  was  to  be  used  to  clear  the  flight  control  system  in  the 
aircraft  prior  to  each  flight  and  thus  its  integrity  and  ability  to  detect  faults  was  to 
be  comparable  with  the  overall  integrity  aims  of  the  FCS.  A  very  useful  fall  out  of  such 
a  system  is  that  it  can  be  used  for  FCS  commissioning  on  the  aircraft  and  reclearance  of 
the  FCS  following  LRU  changes. 

Built  in  Test  Functions  Available 


The  facilities  provided  by  the  BIT  equipment  can  be  grouped  into  three  main 
categories  of  test  class. 

1.  Those  tests  and  checks  performed  prior  to  take-off  which  give  the  pilot 
confidence  that  the  Flight  Control  Svstem  (FCS)  is  functioning  correctly.  This 
comprises  the  Pre-Flight  Check  (PFC)  series  of  tests.  The  PFC  series  of  tests 
fall  Into  two  groups,  those  tests  which  are  conducted  automatically  and  those 
tests  which  require  pilot  participation  for  their  completion. 

2.  Those  tests  and  checks  which  can  be  initiated  by  the  pilot  and  need  not 

be  performed  compulsorily  prior  to  flight.  They  enable  the  pilot  to  test  other 
ancillary  functions  on  the  aircraft  that,  in  their  execution,  require  the 
co-operation  of  the  ground  crew.  These  tests  are  called  First  Line  Checks  (FLC) 
Tests  in  this  class  include  checks  on  incidence  and  sideslip  probes. 

3*  Those  tests  and  checks  which  are  conducted  automatically  in  a  background 

mode  whilst  the  FCCs  are  executing  the  In-Flight  software  of  the  FR£.  These 
tests  are  referred  to  as  In-Flight  Monitoring  (IFM)  and  perform  continual 
checks  on  the  processor  and  system  operation  during  flight.  There  are  also 
signal  consolidation  voter/monitor  algorithms  which  are  used  to  select  the 
control  input  information  from  the  multiple  red  aidant  transducer  and  sensor 
sources. 

The  conduct  and  the  results  of  the  BIT  are  displayed  to  the  pilot  via  the  Central 
Warning  Panel  (CWP)  and  the  Pilots  Control  and  Switch  Panel  (PCSP).  The  PCSP  uses 
coloured  annunciators  to  inform  the  pilot  rf  test  failures  in  PFC,  or  FLC  or  in  the  case 
of  IFM,  a  first  or  second  failure  of  a  primary  or  secondary  sensor  or  processing.  The 
ground  crew  can  receive  information  via  a  Diagnostic  Display  Unit  (DDU)  which  is  located 
in  the  port  undercarriage  bay.  It  is  used  to  inform  the  ground  crew  of  software  identity 
status,  PFC  test  sequence  number,  and  the  identity  of  test  failures.  The  FCCs  have  a 
capacity  to  store  100  failure  codes  for  each  lane  which  uniquely  identify  those  tests 
which  have  failed  and  permit  identification  of  the  failing  lane  and  the  function  within 
that  lane  that  has  caused  the  failure. 

3.1  Design  and  Development  of  BIT  System 

The  tests  required  to  check  out  the  installed  IFCS  were  evolved  using  both  a  top  down 
and  bottom  up  approach  to  test  philosophy.  From  this  assessment  a  basic  systems 
orientated  test  strategy  was  produced  which  identified  the  required  system  test  functional 
areas  and  those  module  areas  where  test  interfaces  would  have  to  be  supported.  The  tests 
would  be  controlled  through  software  and  appropriate  interfaces  were  accordingly  developed 

The  test  objectives  need  to  be  simple  with  clearly  defined  outcomes  in  order  that 
the  assessment  of  the  result  may  be  easily  and  unambiguously  made.  A  complex  test  can 
have  responses  the  assessment  of  which  can  be  demanding  due  to  the  number  and  complexity 
of  interrelated  and  interactive  parameters  which  need  to  be  correlated  in  order  to  define 
a  good  or  bad  outcome.  Software  can  be  written  which  will  effectively  perform  such  a 
service  but  its  commissioning  and  any  subsequent  modification  can  be  a  difficult  and  time 
consuming  task.  In  a  research  programme  one  must  expect  changes  as  flight  trials  and 
development  proceeds.  It  is  important  therefore  to  design  the  flight  control  system  to 
accommodate  such  changes  efficiently  and  to  minimise  penalties  both  in  terms  of  time  and 
cost. 


The  practical  outcome  of  this  strategy  was  the  requirement  that  tests  should  be 
simple  and  understandable  in  structure  and  generally  capable  of  modification  by  changes 
to  the  data  constants  leaving  the  coding  structure  unaltered.  Checks  requiring  more 
sophisticated  testing  methods  should  make  use  of  parametric  changes  or  combinations  of 
simple  tests. 

The  basic  reasoning  behind  the  development  of  each  of  the  tests  followed  a  similar 
pattern  where  test  methods  were  assessed  against  the  test  objectives.  In  some  instances 
what  might  be  considered  the  normal  methods  of  checking  were  found  to  have  shortcomings 
in  that  the  probability  objectives  could  not  be  met.  This  led  to  the  introduction  of 
more  sophisticated  methods  to  achieve  the  test  objective.  An  example  of  this  is 
reflected  in  the  use  of  a  sum  check  sequence  to  check  the  test  patterns  in  both  the 
program  and  constant  stores.  A  straightforward  analysis  of  the  probability  of  bit 
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corruption  in  a  l6K  l6  bit  PROM  store  showed  that  there  was  a  probability  greater  than 
1:  10“ 7  of  a  successful  sum  check  with  2  or  more  bits  being  corrupted.  This  led  to  the 
introduction  of  cyclic  redundancy  check  methods.  This  enabled  comparisons  to  be  made 
with  a  probability  error  of  less  than  2,3  x  (ref.  2  and  3)* 

A  further  type  of  problem  that  had  to  be  solved  is  exemplified  by  the  requirement  to 
checkout  the  failure  absorbing  duo  triplex  actuators.  These  units  are  capable  of 
providing  normal  performance  in  the  presence  of  two  electronic  or  an  electronic  and  a 
hydraulic  failure.  The  use  of  tests  which  fail  multiples  of  input  commands  to  the  units 
could  not  be  used  as  the  response  of  the  actuators  was  indeterminate  in  certain  open  loop 
or  null  command  states.  Using  such  a  method  it  would  not  be  possible  therefore  to  obtain 
definitive  results  to  assess  performance.  The  solution  ultimately  conceived  was  simple 
in  concept,  it  involved  a  series  of  dynamic  tests  in  which  pairs  of  commands  were  set  to 
servo  saturation  at  opposite  extreme  limits.  The  remaining  pair  of  command  lanes  were 
then  used  to  stimulate  the  system  with  an  impulse  function*  With  this  configuration  and 
test  condition  the  actuator  system  had  a  predictable  dynamic  response.  This  simple  test 
was  then  applied  sequentially  to  combinations  of  saturated  and  stimulated  command  lanes 
to  check  the  complete  actuation  system. 

3.2  Entry  and  Performance  of  Pr c-Flight  Check 

Entry  to  Pre-Flight  Test 

Precautions  are  taken  to  prevent  the  inadvertent  entry  into  the  Pre-FJ ight  Check 
sequence  whilst  the  aircraft  is  in  flight  by  a  series  of  interlock  actions. 

For  entry  to  occur,  the  aircraft  must  have  "weight  on  wheels"  the  BITE  press  button 
cover  must  be  raised  and  the  BITE  press  button  operated.  On  entry  the  automatic  tests 
are  performed,  these  take  approximately  60  seconds  to  complete.  Errors  are  automatically 
loaded  into  the  Failure  Identification  Table  (FIT). 

Automatic  Test  Sequence 

The  computer  functions  check  is  a  sequence  of  instructions  which  are  more  complex 
and  not  used  in  the  initial  running  of  the  Flight  Resident  Software  (FRS).  The  program/ 
constant  store  check  operates  as  previously  described  using  cyclic  redundancy  check 
techniques.  Additionally  on  completion  of  the  check  in  each  FCC  the  result  is 
transmitted  between  lanes  and  subject  to  further  correlation  to  confirm  identical  store 
bit  patterns  in  each  FCC.  Errors  may  be  identified  by  display  on  the  DDU  to  a  specific 
store.  Lane  coding  and  stability  setting  checks  follow.  The  stability  setting  defines 
whether  FRS  for  stable  or  unstable  control  laws  is  required,  it  is  predetermined  by  wire 
links  in  the  aircraft  wiring.  The  scratchpad  checks  test  that  all  locations  are  capable 
of  storing  ones  and  zeros.  Those  locations  in  the  Autonomous  Data  Transfer  (ADT)  area, 
where  autonomous  updating  can  take  place,  have  the  opportunity  of  a  second  check  should 
the  first  fail  due  to  an  ADT  update  operation.  Checks  on  the  serial  data  transmission 
system  are  conducted  intra  lane  by  looping  the  data  transmitter  output  to  the  data 
receivers.  Dedicated  bits  in  an  output  logic  word  are  used  to  control  a  series  of  checks 
which  test  both  rate  and  failure  states  for  correct  operation  of  the  failure  response. 

The  discrete  outputs  are  checked  by  loading  the  scratchpad  with  special  binary  patterns 
which  are  re-read  into  the  scratchpad  after  processing  by  the  discrete  output  logic.  The 
check  is  completed  by  comparison  via  software.  Analogue  to  digital  and  digital  to  analogue 
conversion  is  checked  by  looping  back  analogue  output  signals  to  the  analogue  inputs. 

The  loop  is  formed  by  operating  analogue  BITE  switches  incorporated  into  the  analogue 
input  signal  conditioning.  Checks  are  conducted  at  both  positive  and  negative  levels  as 
well  as  the  zero  state.  The  analogue  output  voltage  and  the  corresponding  input  voltages 
are  assembled  in  the  scratchpad  and  compared  using  software.  An  important  feature  of  the 
FCC  is  its  treatment  of  overflow  conditions  in  the  processor.  The  processor  is  designed 
to  behave  in  a  similar  way  to  an  analogue  computer  in  that  exceeding  the  maximum  positive 
or  negative  magnitudes  will  not  result  in  a  «*ign  inversion.  Use  is  made  of  the  property 
in  the  control  law  processing  so  to  maximise  the  resolution  performance.  It  is  thus  an 
important  function  and  is  checked  continually  during  flight  as  well  as  in  pre-flight  test. 
All  combinations  of  instruction  that  would  lead  to  overflow  are  exercised  and  the  result 
checked  for  correct  response.  A  feature  of  the  processor  operational  checks  is  a  check- 
word  monitor.  This  is  a  piece  of  hardware  which  checks  both  a  bit  pattern  and  its  output 
rate  from  the  processor.  A  persistent  error  in  either  of  these  causes  the  data  from  that 
lane  to  be  inhibited,  the  other  FCCs  are  informed  of  this  action  by  a  default  error  code 
from  the  serial  data  transmitter.  Both  the  rate  gyros  and  the  accelerometers  are 
provisioned  with  inputs  which  enable  them  to  be  stimulated.  Signals  of  defined  levels  are 
used  to  torque  the  units,  the  responses  are  input  to  the  scratchpad  where  they  are  checked. 
The  operation  of  the  auto-trim  motors  is  checked  by  confirming  the  rate  and  direction  of 
movement  resulting  from  forcing  functions  output  from  the  FCC. 

After  the  completion  of  the  automatic  tests  the  opportunity  is  available  to 
interrogate  the  FIT  through  the  use  of  the  DDU.  At  thisstage  it  is  also  possible  to 
display  the  software  issue  number.  This  is  unique  to  each  issue  of  FRS  and  has  to 
correlate  between  lanec  before  it  is  possible  for  the  In-Flight  Software  to  be  entered. 

Any  error  is  identified  to  a  specific  lane. 


The  second  phase  of  the  PFC  requires  the  participation  of  the  crew  to  complete  them. 
This  can  entail  an  observation  or  an  action  to  complete  each  section.  The  ADMC's  have 
BIT  which  operates  autonomously  on  receipt  of  the  correct  commands  from  the  FCC's.  Once 
initiated  they  run  to  completion  and  in  the  first  part  require  the  pilot  to  observe  and 
note  the  operation  of  failure  warning  annunciators.  Hie  completion  of  sections  of  the 
test  are  signalled  to  the  PFC  by  the  pilot  operating  the  BITE  press  button  on  the  pilot’s 
control  and  switch  panel.  During  this  series  of  tests  the  consolidation  of  the  dual 
power  supplies  at  each  FCC  and  ADMC  are  checked  by  the  pilot  manually  interrupting  each 
supply  at  the  control  panel.  This  is  followed  by  pilot  checks  on  the  operation  and 
input  range  of  the  column,  rudder  pedal  and  trim  inputs  together  with  some  discrete 
inputs  (push  buttons  and  switches).  The  actuator  checks  described  in  Section  are 

conducted  in  this  section  of  testing  despite  the  fact  that  the  test  is  entirely  automatic. 
This  was  done  to  enable  as  many  tests  as  possible  to  be  executed  prior  to  the  need  to 
power  the  hydraulic  systems  via  the  aircraft’s  engines. 

First  Line  Checks 

These  tests  are  optional  and  may  be  omitted  prior  to  flight  if  so  desired.  The 
pilot  can  select  to  continue  testing  at  the  conclusion  of  the  pilot  participation  tests. 
The  first  line  checks  require  the  co-operation  of  the  ground  crew  for  their  completion. 
They  cover  the  operation  of  the  DDU,  the  pilot’s  control  panel  and  the  air  data  triplex 
transducers.  A  full  list  of  the  pre-flight  and  first  line  checks  is  given  in  Annex  2. 

3-3  In-Flight  Monitoring 

The  In-Flight  Monitoring  (IFM)  software  operates  contemporaneously  with  the  flight  control 
software.  It  serves  two  main  functions:- 

•  to  monitor  the  flight  control  sensor  inputs 

•  the  continual  check  of  certain  hardware  functions. 

Flight  Control  Sensor  Input  Monitoring 

Flight  control  sensor  information  is  provided  with  redundancy  levels  ranging  from 
quadruplex  for  primary  data  to  triplex  and  duplex  for  secondary  information.  The 
selection  of  flight  control  data  for  presentation  to  the  voters  is  achieved  by 
associated  monitors  which  continually  check  complementary  inputs  across  lanes.  Monitors 
are  provided  for  both  analogue  and  discrete  digital  input  signals. 

The  checks  performed  compare  each  lane's  data  against  the  others.  When  a  lane  is 
identified  as  being  out  of  tolerance,  an  error  count  is  commenced.  A  pre-deterrained 
count  has  to  be  reached  before  a  voter  has  an  input  disconnected.  This  is  to  limit  or 
prevent  the  occurrence  of  nuisance  disconnects  that  could  otherwise  occur.  Recovery 
from  a  potential  disconnect  situation  is  achieved  when  the  out-of-tol arance  signal 
returns  to  tolerance  within  the  error  count  maximum.  This  causes  the  error  count  to  be 
decremented  at  half  the  incrementation  rate.  This  procedure  ensures  that  cyclic  errors 
can  be  detected.  When  a  predetermined  count  has  been  reached,  the  lane  sensor  data  in 
error  is  inhibited  from  its  associated  voter  and  the  voting  algorithm  is  rescheduled  to 
reflect  the  new  number  of  valid  inputs.  The  detection  of  an  error  is  indicated  to  the 
pilot  by  the  CWP  where,  according  to  whether  the  failure  is  a  first  or  second  similar 
failure,  an  Amber  or  Red  warning  is  displayed.  With  the  Amber  warning  the  pilot  can 
attempt  re-engagement  of  the  system  by  depressing  the  status  button  on  the  pilot’s 
control  panel. 

Voter/monitors  are  provided  for  all  the  sensor  inputs  each  operating  against  a 
given  threshold  and  error  count  figure.  Any  detected  error  causes  an  entry  to  be  made 
in  the  FIT.  This  can  then  be  read,  after  landing,  via  DDU  to  ascertain  the  cause  of  any 
warning  indications  given  to  the  pilot. 

In-Flight  Hardware  Checks 

Checks  conducted  on  the  hardware  primarily  relate  to  the  operation  of  the  processor, 
storage  and  conversion  sub-systems.  The  instruction  function  and  overflow  checks  ensure 
that  data  is  correctly  manipulated  by  the  processor  and  that  sign  inversions  do  not  occur 
with  instructions  that  could  normally  cause  overflow.  The  analogue  to  digital  converter 
module  has  scratchpad  locations  linked  to  a  dedicated  A-D  loop.  This  loop  is  continually 
exercised  during  flight  to  check  the  performance  of  the  module.  Any  error  causes  an 
entry  to  be  made  into  the  FIT. 


The  operation  of  the  FCC  is  monitored  by  a  hardware  rate  and  bit  pattern  detection 
module.  This  is  the  On-Line  Monitor  which  accepts  predetermined  bit  patterns  at  the  frame 
running  rate  and  checks  that  both  bit  pattern  and  the  rate  at  which  it  is  being  received 
are  correct.  If  erroneous  data  or  excessive  rates  are  detected,  the  remaining  FCC  lanes 
are  informed  via  the  serial  digital  data  link  by  the  transmission  of  an  error  signal. 

This  is  used  in  the  receiving  lanes  to  reject  data  from  the  faulty  lane  and  to  adjust  the 
voter  algorithms  accordingly. 
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A  aeries  of  continual  tests  are  conducted  on  the  scratchpad,  program  and  constant 
stores.  Hie  scratchpad  checks  confirm  operation  of  each  location  (l  bit  and  16  bit)  of 
the  scratchpad  with  true  and  inverse  checkerboard  patterns.  Hie  program  and  constant 
stores  are  subject  to  cross  lane  checks  which  compare  the  entire  contents  of  each  of  the 
stores  with  one  another  cross  lane.  Hie  entire  comparison  process  is  completed  approxima¬ 
tely  every  2.5  minutes.  Any  failures  in  the  cross  lane  communications  system  result  in 
a  receiver  status  being  set.  This  causes  the  receiving  lane  to  ignore  the  data  from  that 
receiver. 

The  sequential  operation  of  the  software  is  checked  through  the  use  of  the  frame 
execution  monitor.  This  is  a  piece  of  software  which  operates  in  each  processing  frame 
to  confirm  that: 

•  it  is  the  correct  frame  of  processing  (i.e.  the  preceding  frame  number  is  one 
less  than  the  current  frame) 

.  that  processing  was  completed  in  the  preceding  frame 

.  that  lanes  are  in  frame  synchronism. 

If  a  lane  is  detected  as  being  out  of  frame  synchronism  (i.e.  master  resets  occur  at 
the  right  time  but  frame  numbers  are  different),  action  is  taken  to  correct  the  frame 
count  and  to  note  the  failure  by  an  entry  to  the  FIT.  The  synchronisation  maintenance 
algorithm  utilises  an  assessment  table  to  determine  the  action  to  be  taken  (i.e.  shorten 
or  lengthen  frame  by  20  microseconds)  in  order  to  keep  that  lane  in  synchronism.  If  the 
adjustment  period  falls  outside  that  achievable  by  the  sync,  maintenance  algorithm,  an 
error  is  flagged  up,  and  the  Amber  warning  is  signalled  to  the  pilot.  He  can  attempt  a 
re-sync,  by  operating  the  status  press  button. 

The  quadruplex  voter /monitors  associated  with  the  rate  gyros  incorporate  inputs 
derived  from  gyro  fail  discretes.  These  inputs  when  associated  with  out  of  tolerance 
input  signals  cause  the  failure  counts  to  be  at  an  accelerated  rate  thus  leading  to  a 
faster  disconnect.  The  fail  discretes  by  themselves  can  also  cause  deselection  of  a  gyro 
input  by  incrementation  of  the  error  count.  A  list  of  the  checks  performed  by  IFM  are 
given  in  Annex  2. 

3.4  Failure  Display  Selection 

Pre-Flight  Check 

At  the  conclusion  of  each  phase  of  PFC  there  is  the  opportunity  to  interrogate  the 
FIT  and  also  to  read  the  software  issue  status.  Th  s  information  is  available  from  the 
DDU  which  also  monitors  test  progress  by  display  of  test  numbers.  Hie  DDU  display  holds 
the  current  test  number  for  5  seconds  and  then  reverts  to  the  display  of  software 
identity.  This  is  recognised  by  having  the  numeral  6  displayed  in  the  hundreds  position, 
the  ten  and  units  displaying  the  software  issue  state  number.  When  failure  identify 
information  is  required,  the  DDU  read  button  is  pressed  for  each  output  of  failure 
information.  When  the  FIT  has  been  read  completely,  the  DDU  displays  8888.  Further 
operation  of  the  read  button  causes  a  repeat  of  the  previously  displayed  failure 
information. 

In-Flight  Check 

As  already  indicated,  failures  detected  by  the  In  Flight  Monitoring  are  stored  in 
the  FIT  and  in  the  majority  of  cases  a  warning  is  given  to  the  pilot  via  the  central 
warning  system.  However,  there  are  some  hardware  checks  which  only  give  an  entry  into 
the  FIT.  This  is  because  their  immediate  impact  on  the  system  integrity  is  not 
considered  significant  enough  to  warn  the  pilot  but  their  occurrence  indicates  possible 
incipient  failure  conditions*  In  order  to  ^ell  the  ground  crew  that  the  FIT  contains 
failure  information,  and  so  initiate  maintenance  procedures,  the  DDU  contains  a  caption 
which  is  illuminated  whenever  entries  are  made  into  the  FIT.  Thus  part  of  the  after- 
landing  check  to  be  performed  by  the  groundcrew  is  a  check  of  the  DDU. 

4.0  GROUND  TEST  FACILITIES 


Early  in  the  programme  definition  phase,  it  was  decided  that  a  representative  ground 
test  rig  should  be  built  rather  than  use  the  aircraft  for  system  qualification  tests. 

The  comprehensive  rig  facility  illustrated  in  Figure  3  comprises  the  following: 

.  flight  control  computer  system  test  bench 

.  powered  controls  actuator  test  bench  including  representative  actuator  mounting 
structure  and  simulated  aerodynamic  loading  facilities 

.  representative  cockpit  including  actual  pilot’s  flying  controls,  flight  instru¬ 
ments  vith  head  up  display  and  computer  generated  outside  world  display 

.  a  three  axis  rate  table 


a  sensor  bench  for  secondary  sensor  testing 


.  a  flight  simulation  computer  capable  of  closing  the  aerodynamic  loop  as  well  as 
simulating  the  control  laws  and  driving  the  'outside  world'  and  cockpit  displays, 

.  a  power  bench  to  provide  hydraulic  and  electrical  power  supplies  for  the  FCS 

.  simulation  benches  for  primary  sensors  and  actuators 

#  a  comprehensive  data  acquisition  system# 

The  facility  can  be  run  in  a  number  of  configurations  enabling  simultaneous  testing 
to  be  performed  on  different  benches  or  in  a  fully  closed  loop  mode  whereby  a  complete  set 
of  FCS  hardware  can  be  'flown'  by  the  pilot#  For  example,  loaded  actuator  performance  can 
be  measured  on  the  power  controls  bench  while  control  law  development  can  be  carried  out 
using  the  cockpit  and  simulation  computer.  The  outside  world  display  is  confined  to  a 
runway,  a  blue  sky  and  a  random  scattering  of  coloured  squares  on  a  green  background 
together  with  a  number  of  cloud  layers#  Although  very  simple,  this  display  together  with 
the  HUD  was  adequate  for  pilot  assessment  of  visual  flying  tasks# 

For  aircraft  test  work,  automatic  test  equipment  (ATE)  was  provided  on  a  purpose- 
built  trolley#  This  powerful  tool  enabled  direct  access  to  the  FCC  serial  digital  data 
streams  and  could  be  set  up  for  a  number  of  automated  monitoring  tasks  as  well  as  enabling 
detailed  diagnostic  testing  to  ba  performed# 

The  ground  rig  is  used  for  four  primary  and  two  secondary  tasks#  The  primary  tasks  are: 

1.  To  verify  the  control  laws  by  pilot  assessment  before  encoding  into  the  computers# 

2#  To  integrate  the  hardware,  the  software  and  the  instr'imentat ion# 

3#  To  validate  the  final  software  before  flight# 

4#  To  gain  confidence  in  the  overall  system. 

The  secondary  tasks  are: 

1.  Each  flight  test  schedule  is  flown  on  the  ground  rig  immediately  prior  to  the 
actual  flight# 

2.  The  rig  provides  an  excellent  pilot  training  aid.  Experienced  pilots  can  practise 
the  failures  peculiar  to  the  FBW  aircraft.  New  pilots  can  gain  first-hand 
experience  of  the  control  systems  and  control  laws,  as  well  as  experiencing  all 
the  possible  failures#  As  with  more  conventional  simulators  familiar  to  military 
pilots,  the  FBW  engineers  have  become  adept  at  thinking  up  the  most  convoluted 
and  esoteric  emergencies. 

The  final  task  of  the  ground  rig  prior  to  commencement  of  the  flight  test  programme 
proper  was  50  one-hour  periods  of  closed  loop  testing  using  the  full  flight  cleared  hard 
and  software. 

5.0  SIMULATOR  TESTING 


Before  the  full  system  rig,  which  is  described  in  the  next  section,  became  available, 
the  initial  investigation  and  development  of  the  flight  control  laws  was  carried  out  on 
one  of  the  Warton  Division's  general  research  simulators#  By  this  method  much  of  the 
early  development  of  the  control  laws  was  completed  far  earlier  than  would  other-ri.se  have 
been  the  case# 

5#  1  Simulator  System  Description 

Cockpit  -  Unlike  the  Rig  Cockpit  the  simulator  cockpit  was  not  modelled  on  the  Jaguar,  or 
for  that  matter  any  other  particular  aircraft,  but  had  a  general  HDD  instrument  display 
and  an  early  version  of  the  Jaguar  HUD# 

Outside  World  Display  -  The  simulator  used  a  simple  Tector  electronically  generated 
outside  world  display#  The  display  was  basically  a  sky/ground  presentation  with  fields, 
clouds  and  visibility  effects#  Runways  and  targets  could  be  simulated  so  that  take  off 
and  landings  and  air  to  ground  tracking  could  be  explored#  The  simulator  outside  world 
display  was  very  similar  to  that  used  in  the  full  system  Rig# 

Flight  Conditions  -  Turbulence,  crosswinds  and  gusts  were  required  for  handling  evaluation 
during  take  off  and  approach  and  flight  at  low  level  and  to  examine  the  increase  in  control 
system  activity.  Discrete  gusts  of  larger  than  typical  levels  could  be  injected  vertically 
and  laterally  at  random  from  the  computer  console.  Crosswinds  with  magnitudes  up  to  and 
in  excess  of  the  standard  Jaguar  crosswind  limit  were  frequently  used#  These  facilities 
were  considered  to  be  essential  to  a  thorough  handling  evaluation  and  are  also  used  on  the 
full  system  Rig# 

Take  Off  and  Landing  Simulation  -  The  landing  and  take-off  simulation  on  both  the  research 
simulator  and  the  Rig  contained  only  a  simple  model  of  the  aircraft's  undercarriage  dynamics 
and  ground  effects  were  limited  to  a  series  of  ground  restraints  upon  the  aircraft  model 
which  came  into  effect  below  a  pre-defined  minimum  height.  During  flight  trials  it  has 
been  found  that  the  stick  forces  to  rotate  during  take-off  are  consistently  lighter  than 
those  suggested  by  the  basic  simulation. 
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Aircraft  Model  Validation  -  Before  any  research  work  concerning  the  FBW  control  laws 
could  be  undertaken,  the  basic  aircraft  model  had  to  be  validated.  To  accomplish  this 
validation  a  comparison  of  a  series  of  step  inputs  at  several  flight  conditions  was  made 
using  an  IBM  computer  which  contained  the  'Jaguar  Master  Data  File'.  The  inputs  were 
made  for  models  of  the  FBW  Jaguar,  Autostabilised  Jaguar  and  Basic  Jaguar.  These  inputs 
were  repeated  on  the  simulator  and  the  frequency,  dampings  and  response  of  the  two 
computer  data  sets  compared.  Once  a  good  match  was  achieved,  experienced  Jaguar  pilots 
were  asked  to  evaluate  the  simulator  model  for  fidelity  with  the  real  aircraft. 

5.2  Results  of  Simulation  Testing 

Phase  1 


Phase  1  represented  a  very  early  exposure  of  the  proposed  control  laws  to  pilot 
comment.  Four  configurations  were  examined;  a  and  b  were  for  a  longitudinally  stable 
aircraft,  c  and  d  were  for  a  longitudinally  unstable  aircraft. 

a.  Clean  aircraft 

b.  Centreline  fuel  tank,  4  x  1,000  lb  bombs  inboard,  2  x  1,000  lb  bombs  outboard 

c.  2  x  fuel  tanks  inboard  plus  leading  edge  strakes 

d.  Clean  aircraft  plus  leading  edge  strakes. 

Even  at  this  very  early  stage  of  development,  the  pilots  found  much  that  they  liked 
about  the  aircraft.  The  following  features  were  highlighted  for  further  development: 

High.  Stick  Forces  -  The  stick  force  per  g  and  the  stick  force  to  rotate  was  found  to  be 
high  in  the  mid  Mach  number  range  from  0*5  to  0,8  and  during  rotation  on  take-off.  In 
most  cases  this  criticism  was  accompanied  by  comments  concerning  the  incidence  limiting 
system.  It  was  concluded  that  the  incidence  scheduling  was  restricting  pitch  control 
at  incidences  lower  than  desirable.  Further  development  of  the  incidence  scheduling 
resulted  in  satisfactory  stick  force  per  g.  The  high  stick  force  during  rotation  was 
a  simulator  characteristic  produced  by  the  simple  model  of  ground  effects;  the  actual 
aircraft  can  be  rotated  to  the  take-off  attitude  with  a  light  stick  force. 

Trim  Change  with  Flap  Extension  -  The  pitch  trim  change  when  both  mid  and  full  flap  was 
extended  was  excessive  with  flap  travelling  in  either  direction.  The  direction  of  the 
trim  change  was  in  the  unsafe  sense,  i.e.  a  pitch  down  on  flap  retracting,  leading  to 
poor  overshoot  handling.  A  modification  to  the  flap  compensation  control  law  reduced 
the  trim  change  with  flap  movement  to  almost  negligible  proportions. 

Poor  Pitch  Response  -  Pitch  response  was  criticised  in  the  clean  aircraft  conf igurat ions 
during  take  off  and  landing  and  at  400  KIAS  at  low  altitude.  Further  control  law 
development  overcame  this  problem  and  the  aircraft  now  has  a  snappy,  quick  pitch  response 
at  all  flight  conditions. 

Low  Roll  Rate  -  The  target  roll  rate  of  150°/second  was  not  achieved.  However,  variation 
in  rate  with  normal  acceleration  was  almost  eliminated.  Tor  example,  at  5»000  ft, 

0.9  IMN  full  stick  rolls  produced  130  to  l40°/second  at  -lg  and  at  5g  as  well  as  at  lg. 
Further  refinement  of  the  control  laws  has  achieved  the  target  roll  rate. 

Departure  Prevention  -  It  was  possible  to  induce  departure  by  using  rudder  at  high 
incidence  with  a  centreline  tank  and  six  bombs.  However,  at  this  early  stage  of 
development,  rudder  scheduling  with  incidence  had  not  been  introduced.  Once  this  was 
incorporated  the  problem  no  longer  existed. 

Light  Stick  Forces  in  the  Unstable  Configurations  -  Hie  unstable  configurations, 
particularly  with  inboard  fuel  tanks,  were  found  to  have  lighter  than  desirable  stick 
forces  and  poor  pitch  stability.  This  criticism  applied  throughout  the  flight  envelope, 
including  take  off  and  landing.  Further  control  law  development  eliminated  this  problem 
and  current  studies  on  the  Rig  show  the  aircraft  to  have  pleasant  handling  character¬ 
istics  in  the  unstable  configurations  throughout  the  flight  envelope. 

Phase  2 


Phase  2  of  the  simulator  studies  of  the  FBW  control  laws  examined  the  changes  made 
to  develop  and  improve  the  laws,  and  also  looked  for  the  first  time  at  some  of  the 
reversionary  control  laws  following  sensor  failures.  As  has  already  been  noted,  all  the 
problems  were  successfully  overcome  prior  to  flight  and  good  handling  qualities  were 
obtained  throughout.  The  Phase  2  simulator  study  identified  the  following  characteristics 

Pitch  Transient  with  Undercarriage  Selection  -  An  increase  in  incidence  occurred  when  the 
undercarriage  was  selected  'up'  in  all  stable  conf igurat ions  and  failure  states.  This 
was  due  to  the  change  in  control  law  gains  effected  by  the  undercarriage  selector  lever. 
The  transient  was  substantially  reduced  for  the  full  system  modes  although  it  can  still 
be  detected  in  the  failure  states.  Thus  even  in  the  failure  states,  it  is  no  more  than 
a  minor  nuisance. 
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Departure  Prevention  -  Only  one  case  was  found,  in  the  heavy  stores  configuration,  where 
it  was  possible  to  induce  departure.  If  the  stick  was  moved  forward  during  a  rapid  roll 
and  then  moved  rapidly  aft,  the  aircraft  would  depart,  Fxirther  control  law  development 
eliminated  such  problems  from  the  practical  flight  envelope.  Later  Rig  testing  has 
confirmed  that  departure  is  prevented  throughout  the  cleared  flight  envelope.  It  can 
only  be  provoked  if  the  aircraft's  negative  'g'  limit  is  exceeded  and  rolling  continued 
through  more  than  720°,  which  is  also  beyond  the  clearance  envelope* 

Stable/Unstable  Boundary  Assessment  -  In  configurations  with  near  neutral  stability,  fuel 
transfer  problems  can  cause  the  centre  of  gravity  to  move  from  the  stable  to  the  unstable 
region  and  vice  versa.  This  situation  was  investigated  by  flying  the  simulator  in  the 
"wrong"  control  law  mode  for  the  actual  centre  of  gravity.  An  assessment  was  made  across 
the  flight  envelope  from  low  speed  to  550  KIAS,  and  during  landing.  No  problems  specific 
to  the  case  were  encountered  within  the  extremes  of  centre  of  gravity  movement,  indeed 
the  pilots  were  pleasantly  surprised  by  the  way  in  which  the  good  handling  qualities  were 
retained  in  this  failure  case. 

After  the  completion  of  Phase  2  of  the  simulator  studies,  the  control  law  testing 
was  moved  to  the  dedicated  FBW  Rig  which  is  described  in  the  next  section  of  this  paper, 

6.0  RIG  TESTING 

The  Rig  facility  was  used  extensively  during  the  initial  development  phase  and 
throughout  the  validation  and  flight  clearance  phases.  The  particular  aspects  of  Rig 
testing  included  here  are  the  validation  of  the  FCS  software  prior  to  flight  and  the 
confirmation  testing  for  the  failure  mode  and  effect  analysis  (FMEA)  of  the  hydraulic 
and  electrical  systems. 

The  validation  of  the  FCS  software  on  the  Rig  prior  to  flight  is  only  one  part  of 
the  overall  clearance  to  flight  procedure  as  described  in  Reference  4,  The  actual  Rig 
testing  performed  can  be  broken  down  as  follows: 

1.  Initial  testing  on  the  Rig  to  confirm  that  all  previous  system  queries  have  been 
cleared. 

2,  Initial  closed  loop  evaluation  where  the  Rig  was  operated  closed  loop  using  FCS 
computer  hardware.  The  project  pilot  flew  a  series  of  flight  profiles  to  assess 
aircraft  handling  and  system  behaviour  over  a  wide  range  of  flight  conditions  to 
identify  any  deficiencies  and  to  give  early  warning  of  any  software  errors.  This 
test  technique  proved  particularly  effective  in  identifying  potential  errors  in  the 

software  and  a  number  of  iterations  were  necessary  before  the  software  was  judged 
to  be  satisfactory.  Having  established  confidence  in  the  system,  more  detailed 
testing  was  then  commenced  as  follows: 

3-  Full  evaluation  of  preflight  check  and  first  line  BIT  functions. 

4.  Open  loop  static  and  dynamic  testing. 

5.  Open  loop  transient  testing. 

6.  Synchronisation  testing.  These  tests  were  performed  to  assess  the  ability  of  the 
system  to  obtain  synchronisation  on  start  up  and  to  re-establish  synchronisation 
after  interruption.  In  addition,  system  performance  checks , including  a  closed  loop 
pilot  assessment,  were  carried  out  with  the  system  deliberately  forced  into 
asynchronous  operation.  The  synchronisation  algorithm  proved  to  be  very  effective 
in  obtaining  and  maintaining  synchronisation,  and  even  with  the  FCCs  deliberately 
driven  out  of  synchronisation,  pilot  control  and  system  performance  in  terms  of 
handling  qualities  was  completely  unaffected. 

7.  Open  loop  failure  testing.  Failures  were  induced  in  each  set  of  sensors  to 
demonstrate  correct  operation  of  all  aspects  of  failure  detection  and  identification. 

8.  Closed  loop  dynamic  testing.  Closed  loop  dynamic  and  end  to  end  transient  tests  were 
conducted  initially  using  an  analogue  aircraft  model  for  frequencies  up  to  50  Hz, 
then  later  with  the  digital  simulation  computer. 

9*  Closed  loop  failure  testing.  With  the  Rig  in  the  closed  loop  configuration,  the 

project  pilots  were  given  a  comprehensive  selection  of  single  and  multiple  failures 
to  assess.  These  included  'ramp'  and  oscillatory  failures  at  various  flight 
conditions  over  the  whole  flight  envelope. 

10.  Pilot  in  the  loop  evaluation.  A  series  of  comprehensive  schedules  were  'flown'  by 
the  project  pilots  to  thoroughly  identify  the  aircraft  handling  throughout  the  flight 
envelope.  This  was  done  in  all  system  modes  and  included  such  unlikely  failure  cases 
as  approach  and  landings  in  spin  recovery  mode  and  undercarriage  up  control  laws, 

11,  Confidence  testing.  The  final  confidence  testing  of  the  system  comprised  50 
representative  1  hour  sorties  flown  with  the  Rig  in  a  flight  representative  state 
including  flight  standard  FCS  equipment.  These  were  ’flown'  closed  loop  by  pilots 
and  engineers  and  each  sortie  included  power  up,  pre-flight  checks,  take  off,  full 
handling  flight  schedule,  as  well  as  arbitrary  general  handling,  landing  and  power 
down. 


Tile  Rig  testing  carried  out  to  verify  the  FMEA  of  Ihe  hydraulic  and  electrical 
systems  included  endurance  testing  in  terms  of  battery  supplies  and  EHP  capacity  as  well 
as  comprehensive  short  circuit  tests  to  demonstrate  the  integrity  of  each  independent 
electrical  power  supply.  These  results  were  used  in  the  compilation  of  comprehensive 
failure  drills  designed  to  cope  with  all  conceivable  systems  failures.  These  drills  were 
then  practised  by  the  project  pilot  and  the  project  engineers  under  realistic  conditions 
by  using  the  cockpit  and  simulator  and  introducing  ’failures'  via  the  cockpit  central 
warning  system  while  the  pilot'flew*  a  typical  flight  profile. 

7.0  AIRCRAFT  GROUND  TESTING 


The  task  of  verifying  thr  performance  and  behaviour  of  the  flight  control  system  was 
primarily  a  task  for  the  ground  test  rig.  However,  a  considerable  amount  of  testing 
could  only  be  accomplished  in  the  actual  aircraft  environment  and  this  can  be  conveniently 
divided  into  four  categories;  flight  control  system  testing,  electromagnetic  compatibility 
testing,  aircraft  systems  testing  and  simulated  lightning  testing, 

7.1  Flight  Control  System  Testing 

This  represented  the  build  of  the  FCS  into  the  aircraft  and  each  sensor  LRU  had  to 
be  checked  out.  With  a  full  equipment  fit,  the  integral  BIT  facility  was  used 
extensively  to  check  correct  function  of  each  sensor  and  proved  extremely  useful  in 
identifying  such  items  as  a  broken  wire  in  the  extensive  cable  r\ins  or  a  faulty  LRU. 

This  facility  together  with  the  A.T.E.  enables  a  very  comprehensive  system  check  out  to 
be  performed  rapidly  us  well  as  providing  a  powerful  diagnostic  tool. 

The  other  major  item  of  FCS  testing  was  structural  coupling  testing.  With  the 
introduction  of  a  high  gain  control  system,  interaction  between  the  FCS  and  aircraft 
structural  modes  is  potentially  catastrophic  in  that  any  instabilities  can  result  in  the 
fatigue  life  of  the  airframe  being  consumed  in  a  very  short  period  of  time.  To  protect 
the  aircraft,  gyros  and  other  sensors  are  positioned  to  give  minimal  structural  feedback 
and  notch  filters  are  used  to  attenuate  structural  modes •  The  first  series  of  aircraft 
tests  defined  the  actuator/airframe  characteristics  and  th*»  level  of  structural  mode  pick 
up  for  each  sensor.  This  was  done  using  external  test  equipment  to  drive  the  actuators. 
The  Jaguar  represented  a  unique  problem  in  this  respect  as  the  roar  fuselage  structure 
is  such  that  there  is  a  strong  interaction  between  the  tailplane  actuator  and  the  various 
aircraft  structural  modes.  This  first  series  of  tests  emphasised  the  value  of  early  on- 
aircraft  testing  in  that  it  identified  below  specification  phase  characteristics  in  the 
failure  absorbing  actuator  under  certain  double  electrical  failure  conditions  and  the 
actuator  was  modified  to  overcome  this.  These  tests  also  indicated  that  only  the  rate 
gyros  were  sensitive  to  structural  pick  up  to  the  extent  that  notch  filters  were  required. 

The  next  series  of  tests  identified  the  notch  filter  requirements  to  cover  all 
possible  aircraft  configurations  including  variations  in  fuel  state,  external  stores  etc. 
Prior  to  first  flight,  a  final  series  of  tests  were  carried  out  with  the  flight  standard 
actuators  to  confirm  satisfactory  margins.  It  is  of  interest  to  note  that  between  these 
tests  and  the  previous  tests,  the  pitch  feel  system  had  been  modified  to  optimise  the 
stick  force  per  g  characteristics.  This  was  shown  to  have  had  a  significant  effect  on 
the  structural  mode  pick  up  at  the  pitch  stick  sensor  to  the  extent  that  a  filter  change 
was  necessary  to  maintain  adequate  stability  margins. 

7*2  1  ctromagnetic  Compatibility  and  Transient  Testing 

Electromagnetic  interference  (EMIL)  represents  a  serious  problem  in  that  it  provides 
a  potential  common  mode  failure  in  a  multi- re dundant  flight  control  system.  In  the  light 
of  this,  a  considerable  amount  of  electromagnetic  compatibility  (EMC)  testing  was 
performed  on  the  FBW  Jaguar  prior  to  first  flight.  The  automatic  test  equipment  was 
used  extensively  during  this  testing  to  monitor  a  large  number  of  signals  within  the  FCS 
via  a  fibre  optic  link.  The  parameters  to  be  monitored,  warning  thresholds  and  signal 
alarms  were  programmed-in  prior  to  each  test.  During  each  test  continuous  monitoring 
was  available  and  if  the  preset  thresholds  were  exceeded,  an  immediate  alarm  was  avail¬ 
able  as  well  as  a  replay  of  the  appropriate  .  ignal. 

TTie  aim  of  the  EMC  testing  was  to  give  a  general  flight  clearance  with  no  limitations 
so  that  the  aircraft  could  be  cleared  to  fly  in  eas  of  intentional  and  unintentional 
sources  of  radio  frequencies  (r.f.). 

To  determine  the  safety  margins  of  the  installed  system  against  the  test  levels  of 
r.f.,  it  was  necessary  to  establish  the  operating  characteristics  of  the  equipment  in 
isolation  from  the  aircraft.  The  tests  to  determine  these  characteristics  were 
conducted  by  Marconi  during  the  qualification  test  phase  of  the  flight  control  system. 

With  the  equipment  installed  in  the  aircraft,  interaction  tests  with  other  on-board 
equipment  were  carried  out  to  ensure  that  the  flight  control  system  was  not  degraded. 
Further  flight  control  system  functioning  tests  were  conducted  to  ensure  no  degradation 
or  uncommanded  responses  were  observed  in  the  presence  of  internally  and  externally 
generated  r.f.  fields.  During  these  latter  tests  the  induced  interference  currents  were 
measured  for  analysis  and  comparison  against  equipment  immunity  levels.  It  was  considered 
that  the  Induced  interference  currents  should  be  less  than  25%  of  the  equipment  immunity 
levels.  TTie  flight  computer  internal  data  buses  were  monitored  for  extraneous  effects 
during  aircraft  ground  tests. 


2S-13 


The  on-aircraft  tests  covered  the  interaction  of  other  on-board  systems  with  the 
Flight  Control  System  and  also  the  behavi >ur  of  the  FCS  during  transmission  of  the  on¬ 
board  transmitters,  the  local  airfield  transmitters  and  other  aircraft  transmitters 
including  radars.  During  the  tests  the  aircraft  was  in  a  ’flight  ready'  state  so  that 
monitoring  of  the  other  critical  aircraft  systems  for  malfunction  during  the  test 
transmissions  was  possible*  The  aircraft  transmission  levels  were  enhanced  either  by 
injecting  higher  power  into  the  on-board  antennae  (antenna  re-injection)  or  by  opening 
equipment  bay  doors  -  the  power  levels  being  enhanced  by  at  least  a  factor  of  4,  again 
with  the  aim  of  demonstrating  a  safety  margin* 

The  bench  measurements  of  the  flight  control  computer  susceptibili ty  were  compared 
with  the  aircraft  bulk  current  measurements  and  satisfactory  margins  of  safe  operation 
(i.e.  the  on-aircraft  induced  currents  were  less  than  25%  of  the  computer  susceptibility 
thresholds)  were  demonstrated  for  the  VHF  and  UHF  bands*  A  comparison  was  not  possible 
for  on-board  transmitters  above  UHF  (Telemetry,  Radar  Altimeter,  IFF  and  Tacan)  due  to 
bulk  current  measuring  limitations,  however,  no  EMI  effects  were  noted  with  all  relevant 
access  panels  removed  and  this  was  considered  an  adequate  safety  margin.  Again  it  was 
not  possible  to  make  a  comparison  at  frequencies  of  26  to  100  MHz  as  no  on-board  trans¬ 
mitters  existed*  At  KF  frequencies  an  acceptable  safety  margin  could  not  be  demonstrated 
as  comparison  of  aircraft  and  bench  measurements  did  not  satisfy  the  4/1  criterion  and 
also  since  uncommanded  movements  were  noted  on  the  control  surfaces  when  the  on-  joard 
transmitter  was  operated  on  particular  frequencies*  The  aircraft  was  thus  prohibited 
from  airborne  HF  on-board  transmissions* 

Using  the  results  obtained  on  the  susceptibility  of  the  flight  control  system,  a 
national  survey  of  known  transmitters  was  carried  out  in  conjunction  with  MOD,  and 
aircraft  operating  limits  with  respect  to  the  transmitters  defined.  These  limits  do 
not  cause  any  major  difficulties  in  the  operation  of  the  FBW  Jaguar. 

Transient  Testing 

The  flight  control  system  is  normally  supplied  from  separate  power  supplies  but 
under  certain  failure  conditions  it  is  possible  that  single  source  transients  can  affect 
all  busbars.  'The  electrical  generation  system  had  been  studied  and  the  equipment 
specified  to  cope  with  the  worst  cases  found  in  the  failure  analysis.  During  the 
equipment  qualification  tests  and  the  flight  clearance  tests  on  the  ground  rig,  the 
equipment  was  exposed  to  transients  and  in  all  cases  was  sa tisfac tory*  The  interaction 
between  the  flight  control  system  and  the  other  aircraft  systems  cannot  be  adequately 
checked  on  the  ground  test  rig,  and  specific  interaction  tests  were  conducted  on  the 
aircraft  in  collaboration  with  a  specialised  MOD  team  from  A&AEE,  Boscombe  Down.  The 
latter  tests  were  carried  out  with  engines  running  and  also  in  the  hangar,  and  consisted 
of  observing  the  effects  of  conducted  and  radiated  transients  during  the  operation  of  all 
aircraft  equipments  singly  and  in  normal  combinations.  The  major  transient,  not 
unexpectedly,  came  from  the  electrohydraulic  pumps,  both  on  switch-on  and  switch-off* 

The  resultant  transients  were  within  the  capability  of  the  flight  control  computers  both 
with  and  without  the  busbar  support  batteries  connected. 

7*3  Aircraft  Systems  Testing 

As  already  described  in  Section  6,  the  FMEA  of  aircraft  systems  identified  all  the 
safety  critical  failure  cases  which  were  then  tested  on  the  rig*  However,  a  number  of 
these  cases  were  aircraft  configuration  dependent  and  so  some  repeat  testing  was  performed 
on  the  aircraft.  This  testing  included  hydraulic  system  behaviour  in  terms  of  primary 
flight  control  actuator  performance  under  specific  failure  conditions  such  as: 

engine  failure  on  take-off 

loss  of  a  single  hydraulic  system  with  the  E HP  taking  the  load 

-  loss  of  both  engine  driven  pumps  as  a  result  of  a  double  engine  flame  out  in  a 
spin  ani  the  two  EHPs  taking  the  load. 

The  testing  also  assessed  the  electrical  genrration  system  behaviour  with  particular 
emphasis  on  system  loading  and  battery  endurances  under  a  variety  of  failure  conditions. 
This  testing  demonstrated  a  good  margin  above  the  theoretical  endurances  and  also  revealed 
that  the  priority  valves  were  uiuECessary  for  the  initial  flying  programme. 

7*4  Simulated  Lightning  Testing 

During  the  design  and  build  of  the  FCS  into  the  Jaguar  demonstrator  aircraft, 
extensive  lightning  protection  measures  were  built  into  the  FCS  and  its  aircraft  inter¬ 
faces*  However,  it  is  well  known  that  the  effects  of  a  lightning  strike  on  an  aircraft 
are  unpredictable,  particularly  on  an  aircraft  such  as  the  FBW  Jaguar  due  to  the  highly 
complex  interactive  effects  of  the  aircraft  structure,  equipment  layout  and  cable  runs. 
Thus  for  the  initial  flight  trials,  the  aircraft  was  prohibited  from  flying  in  areas 
where  lightning  activity  was  likely.  On  completion  of  the  first  stage  of  the  flight, 
assessment,  a  series  of  simulated  whole  aircraft  lightning  tests  were  carried  out.  The 
objective  of  these  tests  was  twofold: 


to  evaluate  the  overall  effectiveness  of  the  design  features  incorporated  into 
the  aircraft  and  the  FCS  in  order  to  protect  the  FCS  from  large  electromagnetic 
pulses 
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-  to  obtain  a  relaxation  of  the  flight  limitations. 

The  testing  was  carried  out  at  B.Ae  Warton  in  conjunction  with  the  Lightning  Studies 
Unit  from  Culham  Laboratories  (UKAEA)  and  RAE  Faraborough.  The  aircraft  was  configured 
into  an  effectively  'flight  ready1  condition  with  certain  exceptions  commensurate  with 
the  considerable  safety  precautions  necessary  to  protect  both  the  aircraft  and  personnel 
involved  in  the  tests.  The  aircraft  test  configuration  is  illustrated  in  Figure  4  where 
it  can  be  seen  that  the  aircraft  was  placed  on  a  test  frame  of  'return  conductors 1  which 
provide  a  return  path  for  the  high  current  pulse  and  create  the  correct  electric  field 
around  the  airframe.  The  simulated  lightning  pulses  were  produced  by  discharging  a  high 
voltage  and  high  di/dt  generator  into  the  aircraft  at  the  base  of  the  pitot  probe  with 
the  return  conductors  attached  to  the  required  part  of  the  aircraft  structure,  e.g.  tail¬ 
cone  or  fin  tip.  Very  extensive  monitoring  equipment  wag  used  with  the  aircraft  measure¬ 
ments  being  transmitted  via  fibre  optic  data  links  to  a  screened  room  where  the  recording 
equipment  was  positioned. 

A  progressive  sequence  of  tests  was  performed  beginning  with  low  level  pulses  (20  KV ) 
^rking  up  to  high  level  pulses  80  KV  and  100  KA.  These  high  level  pulses  were  discharged 
into  the  aircraft  in  a  fully  powered  (electrically  and  hydraulioally )  condition  with  FCS 
engaged,  there  was  no  corruption  or  interference  on  the  FCS.  TTiis  was  a  highly 

satisfactory  result  as  the  high  level  pulses  are  equivalent  to  moderate  to  severe  lightning 
strikes.  Some  extrapolation  of  results  is  necessary  to  cover  the  full  lightning  threat, 
and  the  extrapolated  results  will  be  used  to  assess  the  behaviour  of  the  FCS  as  a  basis 
for  a  final  clearance.  This  work  is  still  in  progress  but  it  is  hoped  that  the  present 
limitations  which  prohibit  the  aircraft  from  flying  in  and  around  predicted  areas  of 
lightning  activity  will  be  rescinded  in  the  near  future.  Obviously  considerable  confidence 
has  been  generated  in  the  design  technique  used  in  providing  lightning  protection  for  the 
FCS  on  the  FBW  Jaguar. 

8.0  FLIGHT  TESTING 


One  of  the  design  aims  of  the  FBW  Jaguar  programme  was  that  the  control  laws 
implemented  in  the  FCS  should  provide  handling  qualities  as  good  if  not  better  than  the 
standard  Jaguar.  lhe  standard  Jaguar  has  a  mechanical  control  system  with  a  simplex  three 
axis  autostabiliser  system.  Thus  the  objective  of  the  flight  assessment  was  not  only  to 
demonstrate  the  basic  performance  and  integrity  of  the  FCS  but  to  carry  out  an  assessr »ut 
of  the  aircraft  handling  qualities.  In  this  respect,  the  flight  trials  of  the  FBW  Jagv  r 
aircraft  can  be  compared  with  those  for  a  new  aircraft  and  the  overall  flight  programme 
reflects  this. 

The  current  overall  flight  trials  programme  can  be  divided  into  five  test  phases; 

Phase  1  comprised  a  general  aircraft  and  systems  shakedown  together  with  an  initial 
aircraft  handling  assessment.  This  led  straight  into  Phase  2  of  the  trials  which 
comprised  a  detailed  flight  envelope  expansion  programme.  The  whole  of  these  two  phases 
was  carried  out  with  "Issue  1"  of  the  FCS  software  which  provided  the  fixed  gains  mode 
of  the  control  laws.  In  this  condition,  the  quadruplex  primary  sensors  are  fully 
operational  whereas  the  secondary  sensors  (airspeed,  altitude,  incidence  and  sideslip) 
although  operational,  are  set  to  fixed  values  which  are  dependent  upon  undercarriage 
position  (sec  section  2.2). 

Phase  3  comprises  a  detailed  assessment  of  the  Issue  2  fully  scheduled  control  laws 
in  a  number  of  aircraft  store  configurations.  This  will  include  a  high  incidence  handling 
investigation  of  the  SDSP  function  and  an  assessment  of  the  stable  control  laws  at 
progressively  smaller  manoeuvre  margins.  Phase  4  comprises  a  detailed  assessment  of  the 
unstable  control  laws  at  stability  levels  down  to  -45&S  manoeuvre  margin.  Phase  5  comprises 
an  assessment  of  the  straked  aircraft  over  the  stability  range  of  +3  to  -10%5  manoeuvre 
margin.  At  the  time  of  writing,  the  third  test  phase  is  about  to  begin  and  so  results  are 
given  for  the  first  two  test  phases  only. 

8.1  Telemetry 

From  the  start  of  the  FBW  Jaguar  Project  it  was  planned  to  use  real  t ime  telemetry 
between  the  aircraft  and  a  ground  station  at  Warton.  Fortuitously  a  Jaguar  telemetry 
cabin,  which  was  last  used  during  the  initial  development  of  the  aircraft,  was  still 
available.  Modifications  were  carried  out  to  suit  the  existing  facility  to  its  new  role 
and  it  has  been  used  throughout  every  flight  trial  to  date  and  it  will  be  used  for  the 
foreseeable  future.  The  aircraft  parameters  which  were  transmitted  to  the  ground  station 
during  the  first  phases  of  the  flight  assessment  are  shown  at  Annex  1.  These  were  chosen 
so  that  the  project  engineers  could  monitor  the  FBW  system  response  and  aircraft  reaction 
during  all  the  test  manoeuvres. 

Useful  though  the  transmission  of  data  has  been  in  its  own  right,  both  the  project 
engineers  and  the  pilots  have  found  the  continuous  voice  ("hot  mike")  communicat ion  channel 
of  the  greatest  benefit.  The  engineers  are  able  to  follow  the  aircraft  through  the  test 
schedule  and  discuss  unusual  or  unexpected  results  with  the  pilot  and  then  take  immediate 
decisions  on  the  future  course  of  the  flight.  In  addition,  test  points  which  take  the 
aircraft  near  to  corners  of  the  envelope  can  be  carefully  monitored. 
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For  the  pilot,  the  telemetry  has  several  benefits,  not  least  being  that  of  a 
willing  scribe  to  record  his  comments  about  every  facet  of  the  aircraft's  handling  at  the 
conclusion  of  each  test  point.  In  addition,  the  project  engineers  are  able  to  give 
immediate  advice  based  upon  their  detailed  knowledge  of  the  aircraft's  instrumentation 
and  FBV  systems.  To  date  no  serious  malfunction  of  the  aircraft  systems  has  occurred 
during  the  flight  trials,  but  in  anticipation  of  such  an  event  the  telemetry  engineers 
and  the  pilots  routinely  practice  their  handling  of  aircraft  emergencies  together  on  the 
FBW  system  rig.  All  the  foreseen  possible  failures  and  the  corrective  drills  are 
contained  in  the  aircraft's  flight  reference  cards  (FRC)  and  are,  of  course,  practiced 
many  times  so  that  the  pilots  can  correctly  handle  any  of  them  without  telemetry 
assistance;  however,  engineering  advice  could  be  critical  in  the  unlikely  event  of  an 
unexpected  and  perhaps  esoteric  fault.  Finally,  B.Ae  makes  it  a  rule  that  all  high 
incidence  trials  are  conducted  with  telemetry  and  a  ground  safety  pilot. 

8.2  Flight  Test  Results 

Phase  1  of  the  flight  trials  commenced  with  a  high  speed  taxi  during  which  basic 
aircraft  systems  were  checked  out  as  well  as  giving  the  pilot  confidence  in  the  ability 
of  the  FCS  to  rotate  the  aircraft  into  a  flying  attitude. 

The  first  flight  took  place  on  20th  October  1981  and  a  total  of  5  flights  were 
carried  out  in  4  weeks.  This  completed  the  aircraft  and  systems  shakedown  together  with 
the  initial  handling  assessment  one  flight  ahead  of  schedule.  The  flight  trials 
proceeded  immediately  into  the  second  phase,  the  envelope  expansion  progranfne.  The  new 
taileron  and  rudder  actuators  represented  a  new  standard  in  terms  of  flutter  modes  and 
so  flutter  testing  was  necessary  to  expand  the  flight  envelope  beyond  the  initial  flutter 
clearance.  The  next  8  flights  were  completed  in  10  weeks  despite  the  loss  of  weeks 
due  to  various  external  factors  including  a  period  of  severe  winter  weather.  An 
indication  of  the  reliability  of  the  aircraft  and  its  systems  including  the  FCS  is  given 
by  the  fact  that  the  programmed  successful  flying  rate  was  exceeded  and  the  test  phase 
was  completed  in  13  flights  compared  with  the  programmed  14  to  22  flights.  This  is 
illustrated  in  Figure  5*  In  fact  the  flying  rate  of  the  aircraft  was  not  limited  during 
this  period  by  any  problems  with  the  FCS  but  by  the  large  amounts  of  data  for  analysis 
produced  after  each  flight. 

The  aircraft  proved  to  be  very  easy  and  straightforward  to  fly  with  excellent  FCS 
reliability.  The  control  laws  implemented  provided  handling  qualities  which  were  in 
general  as  good  as  if  not  better  them  the  standard  Jaguar  despite  having  fixed  gains. 

The  detailed  results  of  the  flight  trials  can  be  divided  into  two  areas  of  interest;  FCS 
behaviour  and  aircraft  handling  qualities  provided  by  the  FCS  control  laws. 

Flight  Control  System  Behaviour 

During  the  whole  of  the  first  two  flight  trials  phases  only  one  in-flight  FCS 
failure  warning  was  encountered  and  only  one  FCS  LRU  had  to  be  changed  because  of  a  defect. 
The  LRU  change  was  a  flight  control  computer  (FCC)  which  was  rejected  during  routine 
servicing  when  the  BIT  revealed  a  digital  cross  lane  transmission  malfunction.  No 
computing  malfunctions  occurred  in  flight  throughout  the  flight  trials.  The  in-flight 
FCS  failure  warning  which  occurred  just  prior  to  landing  on  Flight  13  was  caused  by  a 
delay  in  the  quadruplex  switch  on  the  undercarriage  selector.  This  particular  switch  is 
a  standard  Jaguar  item  and  its  design  is  such  that  it  is  possible  for  there  to  be  a  delay 
in  operation  between  two  pairs  of  switches.  The  FCS  detected  this  delay  on  a  slow  under¬ 
carriage  selection  and  gave  the  pilot  a  RED  FCS  warning.  However,  the  design  of  the  logic 
was  such  that  it  successfully  dealt  with  this  two  versus  two  situation  and  provided  the 
correct  signal  to  the  control  laws.  After  this  particular  flight,  the  in-flight  check 
function  of  the  BIT  was  interrogated  via  the  DDU  and  immediately  identified  the  cause  of 
the  RED  FCS  warning.  To  prevent  a  recurrence  of  what  was  effectively  a  "nuisance  warning” 
the  software  algorithm  which  monitors  the  quadruplex  undercarriage  selector  has  been 
modified  to  allow  these  delays  between  switches.  Thus*  in  overall  terms,  the  flight 
control  system  reliability  and  performance  was  excellent,  generating  a  very  high  level  of 
confidence  in  the  system.  Pilot  confidence  in  the  serviceability  of  the  system  prior  to 
each  flight  was  enhanced  by  the  thoroughness  of  the  BIT  function  which  is  a  prerequisite 
for  system  engagement.  Obviously  in  such  a  demonstrator  aircraft,  the  BIT  contained  a 
good  deal  of  pilot  interaction  which  could  be  automated  to  a  large  extent  in  a  production 
aircraft  environment.  However,  even  this  BIT  could  be  completed  in  about  three  minutes 
after  a  few  practices. 

Aircraft  Handling  Qualities 

The  aircraft  handling  qualities  were  assessed  by  a  combination  of  qualitative  and 
quantitative  assessments.  A  large  number  of  classical  handling  tests  were  performed, 
including  stick  jerks,  rudder  doublets,  slowdowns,  wind-up  turns,  inversions,  partial  rolls 
and  rapid  rolls.  In  addition,  specific  tests  were  undertaken  including  ground  attack  dive 
manoeuvres  and  formation  flying  as  well  as  aerobatics.  The  flight  envelope  explored  is 
illustrated  in  Figure  6  where  it  can  be  seen  that  a  maximum  speed  of  550  kts,  1.26  Mach 
was  achieved. 

From  the  first  flight  the  handling  of  the  aircraft  proved  to  be  excellent,  instilling 
a  high  level  of  pilot  confidence  in  the  flight  control  system.  Over  much  of  the  envelope 
the  aircraft  combined  pleasantly  light  control  forces  with  good  response.  It  was  not  over 
sensitive  to  handle  and  there  were  no  PIO  tendencies  in  any  phase  of  flight  examined.  It 
was  particularly  easy  to  fly  near  the  ground  and  to  land  accurately  and  gently.  The  ground 
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attack  manoeuvres  revealed  good  tracking  performance  and  formation  flying  was  very 
straightforward. 

The  wind-up  turns  demonstrated  good  manoeuvring  characteristics  over  the  whole  of 
the  flight  envelope  assessed  which  included  subsonic  turns  up  to  7-5 &  and  supersonic  turns 
up  to  5g.  Target  *  g's'  could  be  achieved  smoothly  and  accurately  and  could  be  held  with 
ease  even  through  the  transition  from  supersonic  to  subsonic  flight. 

The  rapid  rolling  assessment  included  3^0°  rolls  from  lg  entry  conditions  over  a 
range  of  speed  and  altitude  and  l80°  in  accelerated  flight  with  entry  conditions  of  up  to 
4g.  The  rolling  performance  was  very  good  with  a  smooth  and  rapid  roll  acceleration 
together  with  a  high  sustained  rate.  Figure  7  illustrates  how  the  peak  roll  rate  was 
maintained  both  at  low  speed  and  at  high  levels  of  normal  acceleration.  The  aircraft 
response  to  stick  jerks  was  typically  deadbeat  and  the  dutch  roll  reaponae  to  rudder 
doublets  always  moderately  to  heavily  damped.  The  accuracy  of  the  predictions  is  clearly 
illustrated  in  Figure  8  where  the  flight  measured  dutch  roll  characteristics  virtually 
overlay  the  predicted  behaviour. 

As  the  flight  trials  were  carried  out  during  the  autumn  and  winter  months,  consider¬ 
able  experience  was  obtained  of  flying  in  turbulent  weather  conditions.  In  clear  air 
turbulence  at  altitude  the  aircraft  held  its  flight  path  well  and  at  low  level  during 
ground  attack  manoeuvres  in  moderate  to  heavy  turbulence  the  aircraft  would  drive  its  way 
through  in  an  impressive  fashion.  Take-off  and  landings  were  performed  in  gusty  conditions 
with  crosswind  components  in  excess  of  15  kts.  The  aircraft  was  always  easy  to  fly  in 
these  conditions  and  there  was  never  any  suggestion  of  over-controlling  or  PIO  in  any  axis. 

The  aerobatic  manoeuvres  performed  included  loops,  barrel  rolls  and  slow  rolls.  From 
a  pilot's  point  of  view  the  slow  roll  is  a  very  good  test  of  a  flight  control  system  as  it 
requires  a  well  co-ordinated  control  system  in  order  to  achieve  a  smooth,  steady  roll  rate 
about  a  level  axis.  The  rolls  proved  to  be  very  smooth  and  straightforward  to  fly  and 
clearly  demonstrated  the  effectiveness  of  the  FBW  Jaguar  FCS. 

A  characteristic  of  the  fixed  gains  control  laws  was  that  with  undercarriage  up 
control  laws  the  aircraft  was  neutrally  stable  in  pitch  due  to  the  presence  of  the 
integrator  with  a  fixed  value  of  incidence.  Above  240  kts  this  gave  the  aircraft  a  very 
pleasant  characteristic  described  by  one  pilot  as  if  "the  aircraft  was  flying  along  rails" 
which  was  very  beneficial,  particularly  in  ground  attack  manoeuvres.  Below  240  kts  the 
lack  of  static  stability  became  more  apparent  and  it  was  necessary  to  monitor  incidence 
carefully  in  order  to  prevent  inadvertent  speed  loss.  However,  practice  approaches  to 
low  overshoots  (200  ft)  were  flown  in  order  to  demonstrate  that  it  was  entirely  practical 
to  land  the  aircraft  in  the  very  unlikely  event  that  such  a  failure  to  undercarriage  up 
control  laws  should  occur. 

The  accuracy  of  the  simulation  carried  out  prior  to  flight  proved  to  be  of  a  very 
high  order  and  a  frequent  pilot  comment  was  "just  like  the  simulator".  Only  in  its  lack 
of  motion  cues  did  the  fixed  base  simulation  fall  short  of  accurate  flight  predictions. 

This  accounted  for  the  interesting  phenomenon  encountered  during  partial  rolls  at  high 
subsonic  speeds  described  by  the  pilots  as  "roll  hunting".  If  a  rapid  and  abrupt  partial 
roll  stick  input  was  made  at  these  conditions,  the  initial  roll  acceleration  was  rapid 
enough  to  move  the  pilot's  torso  and  hand  away  from  the  direction  of  the  roll.  Under 
certain  conditions,  this  could  reduce  the  roll  stick  demand  which  in  turn  reduced  the 
roll  acceleration  and  hence  resulted  in  an  oscillatory  roll  acceleration  and  sustained 
roll  rate  which  gently  damped  out.  Initially  only  one  pilot  encountered  this  behaviour 
but  the  second  pilot  was  subsequently  able  to  find  it  by  modifying  his  grasp  of  the  stick 
and  elevating  his  arm. 

This  'hunting'  phenomenon  was  shown  to  be  caused  by  a  combination  of  low  roll  stick 
control  circuit  damping  and  good  roll  acceleration  from  sharp  roll  stick  inputs  which 
coupled  through  the  bob  weight  effect  of  the  pilot's  arm  and  torso  to  give  a  closed  loop 
coupled  motion.  The  natural  frequency  and  damping  of  the  mechanical  control  circuit 
between  the  stick  and  the  position  sensor  on  the  FBW  Jaguar  is  significantly  different 
from  the  standard  Jaguar  because  of  the  absence  of  control  rods  linked  to  a  main  valve 
on  a  hydraulic  jack.  In  fact  the  damping  on  the  FBW  aar  roll  stick  circuit  was  of  the 
order  of  0.06J.  Theoretical  modelling  which  included  the  bob  weight  effect  of  the  pilot's 
arm  confirmed  the  coupling  phenomenon  and  indicated  that  an  increase  in  stick  damping 
together  with  a  slight  reduction  in  roll  loop  gain  would  provide  a  satisfactory  solution. 

A  viscous  damper  has  been  introduced  in  the  roll  circuit  and  the  Issue  2  control  laws 
contain  the  slight  reduction  in  roll  gain.  This  it  is  expected  that  the  partial  roll 
response  will  now  be  satisfactory  throughout  the  flight  envelope.  This  experience 
demonstrated  the  difficulties  involved  in  designing  a  single  set  of  control  laws  to  cover 
all  aircraft  configurations  from  clean  aircraft  to  heavy  wing  stores  as  well  as  modifying 
an  existing  mechanical  control  circuit.  The  roll  gain  was  defined  by  the  high  roll 
inertia,  heavy  wing  store  configuration  and  was  thus  overgeared  for  the  clean  aircraft. 
However,  it  is  still  expected  that  the  single  set  of  control  laws  will  produce  satisfactory 
roll  handling  over  a  variety  of  store  configurations.  The  FBW  team  believe  that  the  aim 
of  a  single  set  of  control  laws  is  a  highly  desirable  one  if  it  can  be  achieved  without  a 
significant  loss  of  performance. 

Ihe  overall  results  of  the  flight  trials  completed  to  date  have  been  highly 
satisfactory.  The  project  pilots  have  consistently  praised  the  aircraft  handling 
qualities  and  as  a  production  standard  flight  control  system,  the  FCS  reliability  and 
performance  has  been  very  good. 


A  high  degree  of  confidence  has  been  generated  in  the  aircraft  and  its  systems  for 
the  continuing  flight  trials  programme. 

In  conclusion,  the  authors  would  like  to  acknowledge  the  special  team  effort  that 
such  a  programme  involves.  Its  success  depends  upon  the  efforts  of  British  Aerospace, 
Marconi  Avionics  and  Dowty  Boulton-Paul.  in  particular,  the  programme  could  not  have 
gone  ahead  in  the  first  place,  nor  have  been  sustained  through  several  years  of 
financial  stringency,  were  it  not  for  the  enthusiastic  support  from  the  British  Ministry 
of  Defence  and  RAE  Farnborough. 
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ANNEX  1 


FBW  JAGUAR  TEMELETRY  PARAMETERS  FOR  GENERAL  FLYING 


1.  Indicated  Airspeed 

2.  Altitude 

3«  Central  Warning  Panel  Events  (6) 

4.  Longitudinal  Stick  Position 
5»  Lateral  Stick  Position 

6.  Incidence 

7.  Sideslip 

8.  Yaw  Rate 
9*  Roll  Rate 

10.  Rudder  Ram  Position 

11.  Starboard  Tailplane  Ram  Position 

12.  Port  Tailplane  Ram  Position 
13«  Pilot  Continuous  Speech 

Note:  Alternative  signals  are  available  for  Specific  Flight 
Trials  -  for  example,  high  incidence  flying 


23-18 


1 


1. 


PRE-FLIGHT  CHECK 


BUILT-IN  TEST  FUNCTION 


ANNEX  2 


Automatic  Tests 

•  Computer  Functions 

•  Program/Constant  Store  Check 

•  Lane  Coding/Stability  Selection 
.  ADT  Scratchpad  Checks 

•  16  Bit  Scratchpad  Checks 

.  1  Bit  Scratchpad  Checks 

•  Intralane  Outputs 

•  Discrete  Outputs 

•  Discrete  Inputs 

.  Weight  On  Wheels  Undercarriage  Select 

•  Analogue /Digital  -  Digital/Analogue  Check 

•  Analogue  Loop  Check 

•  Overflow  Operation 

•  Checkword  Monitor  Operation 

•  Sensor  Torqueing 

•  Autotrim  Operation 

•  Quadruplex  Tracking 

•  Failure  Display  Selection 

Crew  Participation  Tests 

.  ADMC  Checks  (Part  l) 

•  Power  Supplies 

•  Column,  Rudder  Pedal  and  Trim  Inputs 

•  Spin  Recovery/Training  Mode  Selection 

•  Actuators  Check 

•  Failure  Display  Selection 

Pilot's  decision  on  whether  to  carry  out  FLC  or  enter  FRS 


First  Line  Checks 

«  Diagnostic  Display  Unit  Operation 

•  Pilot's  Control  Panel 
«  Triplex  Transducers 

•  Failure  Display  Selection 

IN-FLIGHT  MONITORING 

•  Functions  Check 

•  Overflow  Check 

•  Analogue  Loop  Check 

•  On-Line  Monitor 

•  Scratchpad  Operation 

•  Program  Store  Comparison 

.  Constant  Store  Comparison 

•  Interchannel  Communication  Valid 

•  Frame  Execution  Monitor 

•  Synchronisation  Operation  Monitor 

•  Voter/Monitor  Data  Selection  (Quadruplex  to  Duplex) 

•  Rate  Gyros  Valids 
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